hxxps://github[.]com/nightshiftgaming685-a11y/Blooket-cheats-plus/blob/main/Blooket-cheats-plus[.]min[.]js

Analysis

user interaction
yes
max time kernel
1049s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/nightshiftgaming685-a11y/Blooket-cheats-plus/blob/main/Blooket-cheats-plus.min.js
Sample260825-sd2g2sbl3y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4476	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321436933439103"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{6CE42182-9BC2-4653-B774-3036F7B2430F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2988	4924	msedge.exe	85
PID 4924 wrote to memory of 4476	4924	msedge.exe	86
PID 4924 wrote to memory of 4960	4924	msedge.exe	87
PID 4924 wrote to memory of 4960	4924	msedge.exe	87
PID 4924 wrote to memory of 4960	4924	msedge.exe	87
PID 4924 wrote to memory of 4568	4924	msedge.exe	88
PID 4924 wrote to memory of 4568	4924	msedge.exe	88
PID 4924 wrote to memory of 1748	4924	msedge.exe	90
PID 4924 wrote to memory of 1748	4924	msedge.exe	90
PID 4924 wrote to memory of 1588	4924	msedge.exe	91
PID 4924 wrote to memory of 1748	4924	msedge.exe	90
PID 4924 wrote to memory of 1588	4924	msedge.exe	91
PID 4924 wrote to memory of 1588	4924	msedge.exe	91
PID 4924 wrote to memory of 4720	4924	msedge.exe	92
PID 4924 wrote to memory of 4128	4924	msedge.exe	93
PID 4924 wrote to memory of 4720	4924	msedge.exe	92
PID 4924 wrote to memory of 4720	4924	msedge.exe	92
PID 4924 wrote to memory of 4128	4924	msedge.exe	93
PID 4924 wrote to memory of 4128	4924	msedge.exe	93
PID 4924 wrote to memory of 3648	4924	msedge.exe	97
PID 4924 wrote to memory of 3292	4924	msedge.exe	98
PID 4924 wrote to memory of 3648	4924	msedge.exe	97
PID 4924 wrote to memory of 3292	4924	msedge.exe	98
PID 4924 wrote to memory of 3224	4924	msedge.exe	102
PID 4924 wrote to memory of 2064	4924	msedge.exe	107
PID 4924 wrote to memory of 2064	4924	msedge.exe	107
PID 4924 wrote to memory of 2064	4924	msedge.exe	107
PID 4924 wrote to memory of 5020	4924	msedge.exe	110
PID 4924 wrote to memory of 5020	4924	msedge.exe	110
PID 4924 wrote to memory of 5020	4924	msedge.exe	110
PID 4924 wrote to memory of 5216	4924	msedge.exe	113
PID 4924 wrote to memory of 5216	4924	msedge.exe	113
PID 4924 wrote to memory of 5216	4924	msedge.exe	113
PID 4924 wrote to memory of 5652	4924	msedge.exe	119
PID 4924 wrote to memory of 5644	4924	msedge.exe	120
PID 4924 wrote to memory of 5636	4924	msedge.exe	121
PID 4924 wrote to memory of 3200	4924	msedge.exe	124
PID 4924 wrote to memory of 3200	4924	msedge.exe	124
PID 4924 wrote to memory of 3492	4924	msedge.exe	130
PID 4924 wrote to memory of 4616	4924	msedge.exe	132
PID 4924 wrote to memory of 4616	4924	msedge.exe	132
PID 4924 wrote to memory of 8	4924	msedge.exe	133
PID 4924 wrote to memory of 8	4924	msedge.exe	133
PID 4924 wrote to memory of 5652	4924	msedge.exe	134
PID 4924 wrote to memory of 5652	4924	msedge.exe	134
PID 4924 wrote to memory of 5824	4924	msedge.exe	135
PID 4924 wrote to memory of 5824	4924	msedge.exe	135
PID 4924 wrote to memory of 548	4924	msedge.exe	136
PID 4924 wrote to memory of 548	4924	msedge.exe	136
PID 4924 wrote to memory of 4292	4924	msedge.exe	140
PID 4924 wrote to memory of 4292	4924	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/nightshiftgaming685-a11y/Blooket-cheats-plus/blob/main/Blooket-cheats-plus.min.js
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc12efc188,0x7ffc12efc194,0x7ffc12efc1a0
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,10920376933265229792,16403180408443165436,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2040549378339330275,10180308107963997100,262144 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,1028724921222268226,2086629340316283718,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9233007751606663937,12713080219601292476,2097152 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5797435068432332588,10685730307270623409,2097152 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,12847690255155612084,6764967930005162780,2097152 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,6468987135654152921,9644608209840690536,2097152 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,8595686366896775940,8940613290741395304,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,4570503765108398482,11158907424837238892,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2008138494320021168,17405312662864110614,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2008138494320021168,17405312662864110614,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6384,i,9725864573524074862,11842226478713114758,2097152 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6840,i,4169368919477389933,11691951612346479011,2097152 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6780,i,8932232345154850997,12436874338501226861,2097152 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,1950188356952411684,13178778937446640703,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,5589630845775881492,1946328458788651811,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,16708946590558219452,10863799895740737117,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,5121048850975779243,2199431906772899381,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4356,i,15344194597466779800,395901994174142502,262144 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,219240236614858354,2017007998310683707,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2764,i,4117875049317643161,10692817850412466509,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,1180274749096333106,13490057986954354981,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,18177177821602819426,13115835715282076909,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=1340 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,908783200164394255,16697322445227139142,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,7839666402835759355,6991624270124252746,524288 --field-trial-handle=2224,i,8287006259082124946,8017395838698988637,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5dceef1851a3560da9ca34cec3e8dd533171f824b83d054ffa34621338aef223
MD5 603336e96faad71eeaaef028aff08d18
SHA1 9f58178267e083039671825bbb9d88576ca06fc5
SHA512 93ed528c7e5e333a8e24bfbe394f0a165e476808d05e3408ae385197f1ecd59bf7007115d3acc3fd22c5b754c1bf46efbb3d08fd0a2f5160933bf467aa970e26
TLSH
T1CAE086A805C9C26EA7A5B44793BC934CC390374A97C9EE7E270484857152988A6D77A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 557B
SHA256 880042f18ee5d4c02ce9f5d3862456bd8396ac3b0948cece7594bb7a2c6694bf
MD5 7002f1829c9f3ce298471b552367eb80
SHA1 71190512b6f83d55b0f0846990230c5e626cf407
SHA512 7ecbd7bbcc94da766976c528f3d9c2b9d335426f37418a525f62815147df7e7eba2ef21ee4d7a055fdc54683d6e2937f0e1be43f48d7272d3161be4cd4982741
TLSH
T19BF08B8982C1C3654A40904BE17C631A0290F70BEBCCDC7DA308A48DB822A4DF24C7E5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 66510e28fe6ba205ee30aec7c8992687e42eeaba366675fc09f4c8cc3d6cc893
MD5 f8470d7a9d86187c65a9941d9b675d96
SHA1 b41b4bb718ae4a49cc4a8edaeff607a8fc815bf4
SHA512 30fa1388682449d52d95bee01610bd2760bfc98793c33e77a0082f98a25185829d98bcbdc8253c646ee6925603d9ccd6aac02635032053ccc341eb7c5770a912
SSDEEP 192:VLC+azJd9I5VEo0D4WmvCf0gbf0B3EQZkxM1NsW+QDFC9b+LWwWYdPyk:g+azJd+5Co1WmwHf0B3EwkxM12bQSb+3
TLSH
T1FE12FC8E41AD2425DBB02DF2D4D60C0631BE4BDF8B3B9EC604544AFD2DAF79424B1A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59717d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59717d.TMP
Size 3KB
SHA256 a7098dc96eef81bd0fb61291443636933e4dcc8baee4a690ec311a6ab3d7a695
MD5 95f6ca465b13ca89b62ffc81fe1f4366
SHA1 472ca4691269ae530872470c97297bc1cc3afec1
SHA512 fd79703c0a8af28c66aa61f82be0636712d5fdbdf3e3bee74c0c1a226fd693765cf391ffb07ba9782a3f1d86bc66089e81982cf4f3af7e9dd5fa382b739d675b
TLSH
T15B71812842A23461EBF41AF0E4C31205B57E47DF0B0F0D45189C9FBD6E89364B17178B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 257a3bc53f16113f15e762119aac18d2e58f07b3fd8a6c9a0b9150dc62d0b805
MD5 e1bdf8afcb87b53caae34b94f4ee9659
SHA1 58188b634c285a60c7bdf061d1a69f7c2c23a8c5
SHA512 ea581f063ab42876fac0559226619c2e0c07440de2ad9f80938a410acc230b5b4dc88bfb0dbd8b786427b4d412ecd790fd3d7191333b4f5ac0770516966cfa18
SSDEEP 96:D/OmD5/Uu4ucuBzBmDmtmrmO+umTOxjc7gGO2uCu4mguHuXHzRdt/Gtuku5Buhu3:DWmD5/Udpw1mDmtmrmzzTOxjc7g72vRd
TLSH
T128C16CF743B1866DEA1196F0EA04AF2F8F680411436C7D6989E46E17E3F2571E041B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6aa1767f022ab1a3ddce09f182d54aa6fd49d3a81859ab00abd1d1b329e82c77
MD5 040a4ccefe3f843d5d216385911f9f0c
SHA1 ddd4fe3da32b6ca96a0085298c04f2d020a17783
SHA512 836f9aafd041d48db65db18c7df3939d5be440c257bac9ef43368af51692314ec948f9ac96c298c43c4b3177e61ae25c1ef065289558e626327eca67bb58443b
SSDEEP 192:DhmWvg6gEF1m9mDmtmrmhGzTOxjc7g72vRmb3gTrPtGtkZemGi:DhmWvg6gEF1m9mDmtmrmhG/Oxjc7g72R
TLSH
T18CE179F783E5862DD91156F0EB146E2BCE2C0511836C3D2989E4AF57A3F2871E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9b22e1dcbb7abbeabe08f0136c3981fbf89488e42a789013e6e096df58f98865
MD5 abedecdb5a862811aaddbf4384b48805
SHA1 6a7067bb4fa0b77e810f9ebbce2a80ffb6efe0f5
SHA512 38c84cab05b9219bfc89676549e6b095bd1f46c60a6cf1772c18e648a3f711402a39389e0625813d4293cabaf313bddfc9d8b2e7ffc855be5b2f90ff2dc4c7d4
SSDEEP 192:sxZGRpyM/jK1Ml8UQCj6/fisZw9Srls6D4FdpvcSTr4HW6+WNbTx0QqdiOlKZzgX:sxZGDqm6/fisZQSr9Du+HbhJVu/fGo
TLSH
T1EB82D552AA385A778DE7C61AFA01BB53E7F44063D5854E48A9FCCD1C04E6BED320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 abc8a2601831c57da0643b81fda65e12569c703d57a05475413b230bec4875a2
MD5 89ab8879118cdb46a8500ce8d92ebfc1
SHA1 133e7f3f1ff78ef5bf6614eec1a210da152bcaa3
SHA512 a9ce881210f8f048f265dc4535c931f31bc3f6525cad130ac06b50cccbc4223e17569541b8ed6654e00e5ba7b22aef1a2068bb5977e0de5cd646bcb1eb81a366
SSDEEP 192:sxZGRpyM/jK1Ml8Mj6/fisZw9Srls6D4FdpvcSTr4HW6+WNbTx0QqdiOlKZzg/YE:sxZGD76/fisZQSr9Du+HbhJVu/fGo
TLSH
T1C782D6526A385A778DE7C619FA01BB53E7F44063D5854E48A9FCCD1C04E6BED320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ee502a735871c43034f42264cb9d7043df32a7af24fbae97f2788b5dedb270e9
MD5 f6339e6ddf53ddd02f43662c1b8402eb
SHA1 24763aa3f303f16fc52411e1b7386e0dddd36fd5
SHA512 0bf1739d4641b60feb55ddeb1e197c470c6b7d117e4d88758446bee981404e44742262cf86eda3351d3e03461eb4a7a993a01f576ef0d0aeb833bdd004fc3f0e
SSDEEP 192:sxZGRpyM/jK1Ml8MWO6/fisJwdqGys6DYdp9ck4HW6+WNY0Qqdi/Y4RUv+RIgwJ:sxZGDuO6/fisJwbyDYQHbEJ/+GU
TLSH
T1D762F8426A385A7B8DD7C609FA44BF53E6F80463E5854E48A9FCC91C04E2AED321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e2334f752a22bbcdf6bf3418e842ae3c267205586f9c236c0812a88f918980a2
MD5 67e377a69d339545d8ad0d51c3c4ad7a
SHA1 1c61b06ebdfd2c8bd11208c75fa451b38f0d0a00
SHA512 8d78f32dff61dd27879cb3eb2f8a1f439e76e5fb0d524d4f8a54650beb35165db6c3bbe98844ff70bddea15983573ba2f3a1af00e0a6bb9448bacf36de7a80f7
SSDEEP 768:t18iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdWroikzUnw:t18iJPNWvx76ru1jahALocdtdUw
TLSH
T1A9D20A3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA880C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 3f5e9a30fdff6dde14ce2e9b31d69d1bd5f3a41bb3231cc87b07d0aadf56c936
MD5 ee47e545d5c935b280565da12b694538
SHA1 3aa54bd362674c8756b2240a86367311f292854d
SHA512 e900fc741ab215213cdea81f7ae8711c1f30c56f91e3d5094a29f53432a3d063c21609db72d9b5ae27a41e1ff54d22ee312fdc1398a39d1acff5b3596d334f55
TLSH
T1D63174498EA5CE6FECB041B2167264B8337084CC0325A713983C31317E277AA2A4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 17581c525685094a0e9738b1e5ba440d6ac6c000940966794452104ad5518a66
MD5 a1f324c69f18fd0d75126c1d3b1b9ccb
SHA1 129f94417120dd34d85201e0584752caffef78dc
SHA512 0720deae5c7f3b106321a9312a0add13c962e61ec88d6d9f1a3c2404ce863385b43a4ca8b6e3fec91601881cc41a73a8526005f0167c8159aae7ab05bc4042bf
TLSH
T16651E74E8C0B1E2ECDEE02B325F9045833B029DC13688A53759CA138B9C37695C8DF79
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58abdb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe58abdb.TMP
Size 1KB
SHA256 dc0295767512089701869dd473002eec03c90626934ebffacac189c3e63f642c
MD5 279e804e7522be2ab83a540ef339965c
SHA1 b4ab2c6d323c82fc27bfb2f8dd49d0313668905e
SHA512 6bb47e5bf70e74b3253880b8ea3b23349229b81245d5982e8566d705e674b9200e158442f0d76d7ad9fbf68d5391fe4eda19f539298f88b9f50cd185d25b6013
TLSH
T1E731B94B8B808A1AF8C4417709A3B4B8733588404312B383D87C2139BD25BEE1E4F0DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7da273348017f617d34caf67c8fcba3597d841af19059cd5ae5878c7fda3f648
MD5 9d1ebece96881759bcfd4e05e8f9f9e6
SHA1 18072b0aabeb89ea47904793a734e26cfc1505c7
SHA512 71675a5a1bfdc5d5696f2037f1af99e7d5514bc9e374f89a8f7ceaffb11706890ff9a6bc4fdc31e3df140cf73f945e298d144b000b4a93ee2f61e40e0ff298e1
TLSH
T102E0C0F72EF72840FEBF63E1047198A00241F869D584BC9F1416EB8324613923406C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 54cc918224ea45dd2ba4e8b700a5860aac7d55f9292cd93c8b47b1fefdbe8dcf
MD5 9e7a48b686735452cd8ddc38d9c6a801
SHA1 0b22c3cffb9c8a5e7e0020478ce3f0dfac8e6697
SHA512 0e4884d98c19cb413c97c046f84be28adb3d058004aa4d6e3fea83d5516a127474a0f4b0cc863ae8831c80d81949023e3d0ae40623d53e6fd2128ef25767a84b
TLSH
T1CEA00211895DA055E04416B0A0A112DE721088DC1755A25190AC407C8D5015056E2595
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5904d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5904d8.TMP
Size 48B
SHA256 1c757842a8b128e6d14bbfa9f1dd5bc7af6088bf20aabcd9cdc38939fc7c656b
MD5 a58e36088e4a544540c0d0f7e15f6193
SHA1 92d1537e0d071690d7bb25a64a778cab340e727b
SHA512 9db8f69654b6fdb91185034a4fad04490169a32798a9e1d63a38f1838b71c3cb2afa914dda77f3055ecb63c6b2a9a1136dd587f2e6d830db286a96a8451549a4
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c0f20750695db93025e6f0dccb82dac4169f6dee8041e9ecdcc639ca272954de
MD5 d761af5432f63a377ccf25a20d40388b
SHA1 eac80ad0f44be358c057642d1910f7ea643c8374
SHA512 6fb0f093daa1b983328676548f8c747725977cb9331fe4826492a82a96c71008fe1918c73621c20e6057c903432c751d56884de2ac8364f73338fce5e298eca5
SSDEEP 24:Kd8fzIJamd+e64Wy+JIj06KiJhaK61EEqSmYM58UzyXYdfYrCaHdvLj47/+SIjXn:KgpIVKKwovyhiIvKLC87yNRIRKCsEA
TLSH
T1D591140231BF02022D7E7919A6B087574B81B1B37128E42B7FA954754E2AE344EFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1bb95bf-cd85-430c-b542-1928f260e158.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b1bb95bf-cd85-430c-b542-1928f260e158.tmp
Size 16KB
SHA256 4be78db9a40189dde2f3fd6e1174169a2f10c0aac4c63c88f844924ba089bf2a
MD5 211609c5409d2149ea9a86513752ecaa
SHA1 7f0127e347eb23e8f3397ffb8c876df550663247
SHA512 d08877f08f2c38dfb9fe9c9d443fd361c8b386742f945fec3143df66e327543a3b201a05f6d49285e997398456c25b7b242c9455b3feef1217c7676459d7611b
SSDEEP 192:sxZGRpyM/jK1Ml8Mk6/fisZwdOrls6D4Fdp9cSTk4HW6+WNbTx0QqdiZzg/Y4XUx:sxZGDM6/fisZwOr9Du1HbhJu/YGS
TLSH
T1C772F6526A345A778DD7C619FA01BB63E7F81063D6854E48A9FCC91C04E2BED3217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597872.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597872.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1cb53a725210f366aba344bd66b6519c0b2c5fdd0393a45568e81e142fcf8696
MD5 e0031d37180a326b30c940f7e75985ee
SHA1 2d4ecd40e11807560a31234426bfaa0f4533711f
SHA512 9140720f69e1841504b8ba4074d59a544a9a041694d0744ad4beba0898984ea03263571b70dc11314492c1317cd5842f3a051a800288b4dcc699e4de5807f67e
SSDEEP 384:aiFZ3yFaeO8asNQ8TUNTUlIltTvK03NEQ/72k/rqv994w:RFZ3IzhaZwgXKK/7Kv9d
TLSH
T17DC206F254E7583AD95E5B43A73E3D039E7CC057FA896A50B3995A0CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a0ab64e807794dc6b25532a35b16e5b037ce909d08e5d1acaaae2cd2d89a9ff4
MD5 1f7c27eea1c07bad6ced6dd5e80e642e
SHA1 5924ff1276bcc55d73b317e52987f18ca57b5a4f
SHA512 c4e63de220c4eb2cf33dcfde8ac315db3d96d5f56e3b978d82d1ce87e579eccb11a6a19b72b4c09f534c86a2f6c57b2347bf23fa3e98b9793f83c6eb5ca68f16
SSDEEP 384:43yFaeO8WsN7UtTvK03NEC72k/rqc994w:43IzhWxKU7Kc9d
TLSH
T107827C7668B86D775D93A942F50B3603AF74806BDBCE6F9480EEAB1C05CB1D8130B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef5275be70334d52af67e6d6546171cd76fb2f016340ecdc8091e7feecfa72ed
MD5 549c7fc0ddffe2f4f91f2de458ff4dd3
SHA1 2f1770fb7d7105ce04f9f5afd73e927ec965afb0
SHA512 cd487c4e11fbd72481789e6e71c76853e0a0fa3e495073c62ce4b5418f8cb8450f143969ea273b24fbc69a5ada70d7b1524f77bcc817b783c3634f5e46a57664
SSDEEP 96:ZqONk3QsjpfmUTmDK5ih/cIPURHl8h4otop5T5DQBhPwivh50xy0SFYKQAxsYssY:gONz6kDfQmiUyFUZ9036TQiC5U6
TLSH
T12302FA356C786CBB8EA36E46F54777275FA5112BEA852F84D9E81B1C04D724C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48a5f1b5ac65b9c30b51824e9c7c03ca932da41e86ab32cb7b0f4e577f89f189
MD5 0abdf33ab0bde4a97fad36ab2c6b7519
SHA1 c17baa4122b26d4163bdb24e9a58f10102ef47da
SHA512 7648928e0f3e10962d985c1007a553885ad836b1e14ff9a32c3e187e4a5fb170d19a535c7ba7320a70ca54c62ae077be1c5d20bfea178da1e9fceba04b5aac4c
SSDEEP 96:WqONkpQsjpfmUTgK5ih/cIPURHl8h4otop5TEDQBcPwivh50xy0SFYKQAxsYssXg:9ONp6kdQmiUyWUm9036r1EYrcR+qRU6
TLSH
T12F12397168B8BC7B5DD3A842F48736135FA58127EF896F91C5EC2A1C05DB28C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 96ca863390b8adeac4b975be083798acb8c06733559b1900a97df41995e51dc5
MD5 77ffaca199491d727d926096c9879d1a
SHA1 6f3bd3e0c547a99ee21d64fe1302e25297e766a0
SHA512 9ffa8db5cd19bcb876e60e32469c2054e483c9d79ad995da867c40970268ae8646abf0f337a1691b62a8c6289171bd947e6080aa3ad8c8bf5d8e2726fb2bde76
SSDEEP 384:Q3yFaeO8WsN7UQTvK03N+J72k/rqc994w:Q3IzhWaKv7Kc9d
TLSH
T148828D7668B87C775D936942F50B3603AF74806BDBCE6F9480EEAB1C05CB1D8130B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1f4beb80f1d23da3bcd62099fa15cf26b1a16c10ae01b2293b04d939ce575c3e
MD5 e75f6119f3411487f8397cfa29c6dd64
SHA1 253ef350a9199890fe0281bbf189e2895991f541
SHA512 0c4ca1d8976aa6e6af0093c781be7a6d7e8e2fc2c2df810e2406ee30a04adb24cde2466e2f43294c257621f046bcd1de113553f74c1e3574ab86fe85f065a7c8
TLSH
T16BE00103D35205ECC429137100071F605AC392301060029D6F6041683CA73263E61AC8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8ba31236cfca90d97cd97f9f14614d3f7fbdc5526012b07381610eceb263a11d
MD5 5866be8c05ec24549f66d22d729178c8
SHA1 2b5b1144f6d72f2d7ccfe6a089e76d1d35685ef5
SHA512 fcab01faef47793f7da474b2e5eeb59048e3a26496a2ef3a6b51316ed733f1c9370af601f2d6b0187d8e33d92c4cb793e9a5752500708298ddde1dc7f43b0968
TLSH
T12CE00113D35205DDC425137100471F646ED392301221029EAF70416C3CB33263E61AD8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fcf5c70467f08239552ff94d490211f0e229258fe20365704765cad48e4136d4
MD5 204aa1c5d743498200a0911e7273f0c8
SHA1 c15bee04310da785fd66f5026d56784a27b814d6
SHA512 b38dfed23c06e163281c62c3ad4e9a4f5d7e6779a06cd512b301d78c0d32ba8e8ea627ac1b1b9313f9d2c7bd0ece2ead70e858415a2c06b9de84ad607bb1bb13
TLSH
T1BBE00203D34205FCC424137000431A2016C39030147002896E5001503C573202D70FC8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58de84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58de84.TMP
Size 392B
SHA256 7b283f1fc7dd7e1c77491d322462f71ab4323e667b618cec61aea2c0c49ce162
MD5 41b4ed4842330052cf662c8209403d58
SHA1 b9cc1224487c055b2fd344efb50dd891b5e7597f
SHA512 42f5c19c1570bf5ca451d76bd0f100880698e78160acac21ab733e3fb0efb5a9b070207de07045bca865458638fccafd6df0975e8bdf63b91898f94e0761ef5a
MD5 SHA1 SHA512

Submit Download

a407369b-d40a-46e2-afca-34c78fccb0a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a407369b-d40a-46e2-afca-34c78fccb0a6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d24a26043ec2b30ddd571a2c17785323f849167479e7198682725fd1f9375368
MD5 423bb02be593d71080b1e6e2aa1abdc1
SHA1 1a48c729015afd019202e1a379add2aa50b8ea70
SHA512 4fdfe3865b60ad2849b49c621a88a9fec168865dee9a8781a6b3ad9f756031b52704e60f22e9c156b8e94cf637d29e9e6fb60b909a4195a8ace8f22791e3f131
TLSH
T16941F958AAF91148B3776F1A9FF6A46E48BABD772F06D55D00010E4F0A73E40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download