hxxps://github[.]com/nightshiftgaming685-a11y/Blooket-cheats-plus/blob/main/Blooket-cheats-plus[.]min[.]js

Analysis

user interaction
yes
max time kernel
1799s
max time network
1112s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/nightshiftgaming685-a11y/Blooket-cheats-plus/blob/main/Blooket-cheats-plus.min.js
Sample260825-sethtstgmc

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
126	raw.githubusercontent.com
127	raw.githubusercontent.com
128	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321437782750852"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{05DF4FB3-78FD-4359-9D67-318BF74139D8}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5092	4732	msedge.exe	85
PID 4732 wrote to memory of 3440	4732	msedge.exe	86
PID 4732 wrote to memory of 3236	4732	msedge.exe	87
PID 4732 wrote to memory of 3636	4732	msedge.exe	88
PID 4732 wrote to memory of 3236	4732	msedge.exe	87
PID 4732 wrote to memory of 3236	4732	msedge.exe	87
PID 4732 wrote to memory of 3636	4732	msedge.exe	88
PID 4732 wrote to memory of 2364	4732	msedge.exe	89
PID 4732 wrote to memory of 2364	4732	msedge.exe	89
PID 4732 wrote to memory of 2364	4732	msedge.exe	89
PID 4732 wrote to memory of 1212	4732	msedge.exe	90
PID 4732 wrote to memory of 1212	4732	msedge.exe	90
PID 4732 wrote to memory of 1212	4732	msedge.exe	90
PID 4732 wrote to memory of 4876	4732	msedge.exe	92
PID 4732 wrote to memory of 4876	4732	msedge.exe	92
PID 4732 wrote to memory of 4876	4732	msedge.exe	92
PID 4732 wrote to memory of 4404	4732	msedge.exe	93
PID 4732 wrote to memory of 4404	4732	msedge.exe	93
PID 4732 wrote to memory of 4404	4732	msedge.exe	93
PID 4732 wrote to memory of 3476	4732	msedge.exe	97
PID 4732 wrote to memory of 3476	4732	msedge.exe	97
PID 4732 wrote to memory of 60	4732	msedge.exe	98
PID 4732 wrote to memory of 60	4732	msedge.exe	98
PID 4732 wrote to memory of 4288	4732	msedge.exe	102
PID 4732 wrote to memory of 4348	4732	msedge.exe	109
PID 4732 wrote to memory of 1064	4732	msedge.exe	110
PID 4732 wrote to memory of 4348	4732	msedge.exe	109
PID 4732 wrote to memory of 1064	4732	msedge.exe	110
PID 4732 wrote to memory of 1064	4732	msedge.exe	110
PID 4732 wrote to memory of 4164	4732	msedge.exe	112
PID 4732 wrote to memory of 636	4732	msedge.exe	113
PID 4732 wrote to memory of 3588	4732	msedge.exe	114
PID 4732 wrote to memory of 216	4732	msedge.exe	115
PID 4732 wrote to memory of 216	4732	msedge.exe	115
PID 4732 wrote to memory of 1240	4732	msedge.exe	117
PID 4732 wrote to memory of 1240	4732	msedge.exe	117
PID 4732 wrote to memory of 1240	4732	msedge.exe	117
PID 4732 wrote to memory of 2584	4732	msedge.exe	118
PID 4732 wrote to memory of 2584	4732	msedge.exe	118
PID 4732 wrote to memory of 540	4732	msedge.exe	119
PID 4732 wrote to memory of 540	4732	msedge.exe	119
PID 4732 wrote to memory of 540	4732	msedge.exe	119
PID 4732 wrote to memory of 3656	4732	msedge.exe	120
PID 4732 wrote to memory of 1840	4732	msedge.exe	121
PID 4732 wrote to memory of 1840	4732	msedge.exe	121
PID 4732 wrote to memory of 1840	4732	msedge.exe	121
PID 4732 wrote to memory of 2700	4732	msedge.exe	122
PID 4732 wrote to memory of 2700	4732	msedge.exe	122
PID 4732 wrote to memory of 2700	4732	msedge.exe	122
PID 4732 wrote to memory of 2252	4732	msedge.exe	123
PID 4732 wrote to memory of 2252	4732	msedge.exe	123
PID 4732 wrote to memory of 388	4732	msedge.exe	124
PID 4732 wrote to memory of 388	4732	msedge.exe	124
PID 4732 wrote to memory of 4892	4732	msedge.exe	125
PID 4732 wrote to memory of 4892	4732	msedge.exe	125
PID 4732 wrote to memory of 1900	4732	msedge.exe	126
PID 4732 wrote to memory of 1900	4732	msedge.exe	126
PID 4732 wrote to memory of 1900	4732	msedge.exe	126
PID 4732 wrote to memory of 3772	4732	msedge.exe	127
PID 4732 wrote to memory of 3772	4732	msedge.exe	127
PID 4732 wrote to memory of 3772	4732	msedge.exe	127
PID 4732 wrote to memory of 4480	4732	msedge.exe	128
PID 4732 wrote to memory of 4480	4732	msedge.exe	128
PID 4732 wrote to memory of 4048	4732	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/nightshiftgaming685-a11y/Blooket-cheats-plus/blob/main/Blooket-cheats-plus.min.js
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa5408c188,0x7ffa5408c194,0x7ffa5408c1a0
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1864,i,4860935693059920489,3431340561532495240,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,3822020176983484167,16459969001765588998,262144 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:2
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2308,i,16635141905436566207,11436270470010469744,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,17525225885377851712,9436855007984557285,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,14769649356213753181,7337645640380559613,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,17021937047720604263,9589255318523190867,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,6052451312502244809,17587776103050536341,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5112,i,16416573583216212451,11330384822741421795,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5124,i,3060649588693263695,5886639319160355734,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5900,i,1111396457455889021,12573688874690718041,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5900,i,1111396457455889021,12573688874690718041,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4316,i,4510825272606299568,7373015890835901564,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4492,i,13093261656443681562,16639397822280090281,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6524,i,16997533691817473880,10845293776371461127,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6540,i,3929606858333763683,15184025596027898357,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6544,i,5106065551340162387,3910916376409418927,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5280,i,12148028572858426658,10341879863223283625,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4264,i,230652583250148973,4017246690842537057,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2144,i,6365832654703625432,9840754824310771395,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6292,i,14554483347514035846,8096783805297876233,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,4375418089708335601,1258542326683151500,262144 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5332,i,3964924135985347265,10720983891788760299,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2652,i,17606584628902159272,1456728094935358055,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5456,i,5562598045049621719,2687796044865998248,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4352,i,17926319878682041245,10721645216229508874,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6576,i,4241314215717313502,11385266010146573434,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6836,i,2849677699901165668,14732494098820300582,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6976,i,2274941906376231980,17571460972261638783,2097152 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6500,i,861750675108109690,16408300289832828714,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6388,i,5868364491366897366,17260351503026555179,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4396,i,9939068494693415527,8721036513289103511,524288 --field-trial-handle=2828,i,9846655878308414632,1789373155283517474,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 56b4ab9e66c256dad057e7b970e023bd24a999a0ac616fb3c88c727aabf0bcfe
MD5 1e5938f9dea9e379e0e4f8588d5c4362
SHA1 c8ef210012a498144359c9cc49a4e618c5cba4d4
SHA512 a95ecba474c9e0c6f4cfe823e2778012cb71eda125d3efeb4e7529399fb820afd4869fea30bf286b100ef0131db3d72efdeb0460433e77f21fd91d7430277301
SSDEEP 192:sjkD6Gzzzz8888NNNNmmmmfffffoooppppCM5LO:sjkD6Gzzzz8888NNNNmmmmfffffooopO
TLSH
T136E1680286E5D39B8F1660DB4BF4625D01713709EBDDD928278C8EDD704F8AEF4B6A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 68d72b694cceb6d09c92f73d04c9509f085b8ccb7fc2f99b46fa8b31ac871a96
MD5 4e91481ccc23f585fcc5a75d9ecefd49
SHA1 389cc8f76a04203890860dea9beaac6d6cf63317
SHA512 557a41857d8949ce36cfaf98f169dfd65fd02714bfd6ce0024b84106fa4ded0cacad55dd4268cd0c9b6eb025a4116a17b0b9d47537313d2c442e923eb046c7ac
SSDEEP 192:yj776eDDDAARWJ44444zzzzKKKKKttttMMMM5LO:yj776eDDDAARWJ44444zzzzKKKKKtttO
TLSH
T122E1684282D5C3ABCF0561CB49A9635D01703709EFDCE90817AE8EEDB04ECAEF5B5690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 5663a16d1eae37e09527c61766055354567ac8199ee4a70505a22b1e62df3723
MD5 42ca7b6504cb90de8c49076d3f42d79c
SHA1 5304070176813d282bb28c5a22759e2dda11afa0
SHA512 ac625a9464c16cea89091156ca44e11893cd06b8244c7be77a33bad222e1b9e8694c399c6b53a44894a0ed64ab98ec840d06278372f58b2bcd15ff65cb899d05
SSDEEP 192:ljwO6fLLLLLLLLLLLLLLLLLLLLLLLLLLLLLM/LO:ljwO6fLLLLLLLLLLLLLLLLLLLLLLLLLL
TLSH
T149E140434AE5C3AFDF0516CB8EA4635D01707709EBDCD90813DD8DDDB08E8AAB9A1A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 6b042cab517117679a12a43056f10c26bfe238043b8e31eba9c0fe3db8b0b9b0
MD5 848589f0881d7348c251aebae99d3aa0
SHA1 66fd751aba3dcc5ca9e8fe26c58b75d54d27112b
SHA512 68f0955f271bc04bdd8f0a5af9a7098f0c02e8d34eb6810c74dabd9fe79019956779eb01e04d33e3679d921bec8a1db4951a131cee6d4c26644ccf5976a27561
SSDEEP 192:xZjMu6EhOO7AAddKK3+RRR6mIpfWQujmcIZZPM1LO:bjMu6EhOO7AAddKK3+RRR6mIpfWQujmz
TLSH
T1C8E1791282D5D39FCF1914CB4DA4635C01B9370EEBECDD08178D8DDD708E8AEB8A1A98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks
Size 1KB
SHA256 ad9c0357673dd68be83dc1df9abe28aca0a67ea528264c97d05fea4a7a5228b3
MD5 a28ac2fc70152bbffd0ced988a971946
SHA1 1ed24f6f5b79585bac9b9c30fe26cce2dd585b4d
SHA512 e28fc7a149b8ef32c575d19fafbc3a183e8a2ef4b5cc3b646531536c96363752a71b5aa5f6e948769dd200fe3a3107f5966358a9f816a19b786091ebf42df277
TLSH
T1CA31E437D217AC8B59B52596C9B0C387FA00833FA2024D87757CE4DC8F76D2B6285E58
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks
Size 1KB
SHA256 5be1fe494f4779805085727142277ad23dc74433b826c8cbd8bd2a3cc26ef9d4
MD5 b6beb7401c902a7804257298de457d19
SHA1 15105fca65fb54e146f7d118953d2188680f4026
SHA512 c9c5bd3e96214d3f7d0f721c937ac3a56d387ef91739d6639e43c42436cd71f84fd8408f7164c6075799071b9c13c5617ad14b805ffb8bf0081c48ffde807a6b
TLSH
T12B31D677D217AC8759B42596C8B0C343FA00833FA2064D87B97CA4DC8F77D2B6245E59
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks~RFe58ed0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks~RFe58ed0b.TMP
Size 1KB
SHA256 b584ca9c7bc58796740d1d7fa613368ce7d11bc6326db3cf1b493b43d1ba3b87
MD5 1b29c4d79c89876e60584c10a043d8d8
SHA1 27f052dba09fe6ea307b58fbb6fe24aecade85d4
SHA512 d3d410e6443a924f002e792ed013a96e9a370c297fe9c74833c988d88cce44237245b0bd9f81344e5b1824b778badd14f7519ca8ce8bb56fc38973aa4f1629d1
TLSH
T18E31E577D21BAC8759B46596C8B18343FA40833FA2020D47B97CA4DC8F77D2F624AE58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a7c7b772b51c8e95a021c7f934f2887f3b1aea1ae8baaccadda1d9aa640d0fb5
MD5 7ab429991c74787c1a2ae0bda6cf9323
SHA1 62d80a0cde277e3726e4326b66a6c7a96463ec50
SHA512 b9aa5d34070b4cb0117b60b0092f097da411b42af132a37ab6c2b72e097b0364129b94508dd47af5eb2c89a407a03a4531be9db114ec34103803eec14c2deed4
TLSH
T109714CF902AF30A2E7218630D4D316FCB47B4066DB237D5181409DBC6AC6BD983EEC58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589507.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589507.TMP
Size 3KB
SHA256 bd5c153e264059c942c71420254c02b5815e3fea992ba8d3abc657652073eda1
MD5 866f7ded044e2ce122c49d9e836c857c
SHA1 35971e412a0f19a1f97f10fbc4c58b8565bf35bb
SHA512 d86de66dec22de2000fae5964c5acdef45d30a0306556bc80e2664e6b4c455204660c4d1f1580f7157ef90cca76745cd46e376f5aa0f159e6e6e73a3859bdb60
TLSH
T1E2714EF912AB3461D7248230D4D306FDB4774055DB237D51C1009DBC69C6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9cd2507f4da0bdd77f5dbef4f1014960bd9ed052c16eb536ced388bdab805542
MD5 90f95390617e5096f04b660615890d35
SHA1 0bc88796c102566d49950a29ad60323ac2baaa4b
SHA512 9e902f785481f26245a433aaca4c1e34943e34e8a2183d2058fa522179cd47b42e9cd968b73af72978254c7ca52b70c7e1f89633711466c1378ceb0c47602827
TLSH
T1CF417CF787E5956D8A0116F0AA18EE2BCE1C0515831C3C6985E4BE57D3E3871E14276F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 10ff8b7c2a789e23bbb27857a035ed509b3333fb3586ed3a7ec65bed995b9dbe
MD5 d3382551226931a1bd14efe55feea8e4
SHA1 4e39d81b0d7feeb90fd1ad2feed0edd5607fe022
SHA512 6507fa52530c5f4f987b69d306ad9e133dda37e9b968494cd7d4bdf63b65f754fd307c2f9e561e6bf9503accd7d2d078821f358dc683477dfa4654db55f1aea9
TLSH
T1CF41CDF387E1856D8A0115F0AA18EE2BCE2C0511832C382985E4BE57D3E3471E102B6F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 95010f928cb4d53a1619cb83b1b8eb989d40ae3ae867321f9b149baf5ad1d696
MD5 81b595976eb839e3fce6a9d89a05d25d
SHA1 efd98f6385e75a4b140b683dacc5bda489695f58
SHA512 c717f119fd374a08c30108105711617a55372431a4e50bd6628b5b20650a7acc6aa058acca4cc9083743e9dfe68d4ebc7c75c3687af3b3c2c83b32dbb4f99395
TLSH
T10B416BF747B1956EDB1155F0AA04EE2BCF6C0111836C787986E0BE52D3E3471E042B6B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3a6b4401281ee3f431930bcc87f4847e981554b2dd82e4e2ca5f6a7163731957
MD5 9f53ff51b250c0816fff2c252cc27542
SHA1 caf5fb39ccb21835d2c4b166bfbaeeba9c7c67eb
SHA512 a44625f3de62b943716c7840f1702048834028db6e8810b9d53884c0bde30a47ad628a121a206b8303e2cf932a91e502209ed902b658f26308d6e8d2e5e65726
TLSH
T11A416BF747B1956EDB1155F0AA04EE2BCF6C0111836C787986E0BE52D3E3472E042B6B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3d6115d0d3fd7908f19930f43cee65891d2cfe7e8d61753d7cae02b1378d5ba5
MD5 d01c976b8f6a0f38e834ad13734f3871
SHA1 1f75526c9cb784ae9fd3d5b06266256c8313a603
SHA512 8f20e1833afe6147cc053d23ad9537047a22c064e156f984560704395197625e1e7158a54787a87805d637bf54da37be7e7ba971d4a556cd8999159159435977
SSDEEP 192:sxZmRlyM/jK1Ml8Mke/fvs31CJIdpDKHW6+WNYmc/YHPQF+IgrJ:sxZmPMe/fvs3ECeHbO/49
TLSH
T18752D7126A38A977CCCBD209FA55BF53D6F50472A2951E44A9FCCA1C04E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 64fada2ac1ee1fda9c8bee7f8533ea6c72cf08022492d5ec75d6c6d2ab4b03ce
MD5 356a92237a870b5e147426a88a8b9739
SHA1 b09cb06335e8d709f10831f86b5c3c5c6ce4b023
SHA512 97ace26f6fe5208639e7e68d69773d4ba31d6ceb1036dadb5337e933baf37bf38341e5e47211a303cfa1dd24dc2f21d91ee688a444b19275a2022d6c0838ed9b
SSDEEP 192:sxZmklyMojK1Ml8UQx9e/fvsB0CAIdp5USHW6+WNc4+1dYHbne+Ig56J:sxZmFqTe/fvsBnBhHbud44
TLSH
T19762E8126A385977CCDBD609FA51BF53E6F41472A2960E44A9FCCA1C00E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f2345bd4e3dddeb5ba433a41acb60f182da6731e42cc522af75a996b8f7c057d
MD5 2e40f381c2b5453da1426b023e0ffece
SHA1 e068919c246dd794ebb9cb67ae9c5d443a0ab6e9
SHA512 40bf4635c7406c71c91877f3a10efbd4dd1d19a2d11fa78b2463f8b9e1be486016c7fabdc182d07935af08aae248d9f91b6516702849d69898fa519b4b39d74f
SSDEEP 192:sxZDklyMojK1Ml8UQx9e/fvsB0CdIdp5UsHW6+WNc4+1nbD/YHqne+Ig56J:sxZDFqTe/fvsBnenHbuf/94
TLSH
T18262E9526A385977CCDBD609FA51BF53E6F50472A2960E44A9FCCA1C00E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e3b1154b16a3538fcf8e5d75af563bd51d3df0a220a3d1956e06d7ea875248ea
MD5 a371584d1abc0e20ce0875000bcd4c07
SHA1 849bcaac0ac7c75949a211018e321be7d555acdf
SHA512 8a39e8c6cc8b8bb2715be5df84a8fb81a73857ab2fc96eed535a5a1d54c1fd15f1fdbd89fc67331308f803228f638df769abfdd1a57ad53b296148c8ca849f45
SSDEEP 192:sxZmklyMojK1Ml8M9e/fvsB0CJIdpDKHW6+WNYmc/YHBMF+Ig56J:sxZmF1e/fvsBnCeHbO/o4
TLSH
T15252D7166A386977CCCBD209FA55BF53D6F50472A2951E44AAFCCA1C00E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6100bf61d45cea9e67eb43c773104e0b80e80a61ead76f31c82f9c042d1d2eb2
MD5 ae2a728d3fb98437031450ac56cbabe9
SHA1 b7a40549ab426b812e2127eb6224f8b02d07f273
SHA512 5a775a227d135996235ad2d03044a60c152064cb23b22b4bc6144a65b0cf95849ba996c4a87ea2d1c34f187cb9fd0a86d81e392276e95ebe813dfb3c5b063c0e
SSDEEP 768:uRUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RRroVQ0C:uRUZYTMWvg0Pou1ja7eLZmRqJC
TLSH
T111D20B2F284CCB7E4F844E9DEC266F963ED801CB5A984D5447EA884C03C76EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 8d374dbfd4b062306db15bb2588b1f27458af375d9c2ee82bfd167b22e1b700b
MD5 e87fedeed155ba326a9bdcdb558aef0c
SHA1 d7bf311ddfeb19beb7b818ccf65c60a108076122
SHA512 87a457b3e39140fde17604b2a2b81a92cdfd680f9dcd15bfacb8bbcdb732e01d75c40acc37dcc16c81dbd9534d00d6b41e5adbfb382277ddf046fb2f6cb4c227
TLSH
T16021EF4D9EA08A8FF96441B61576B5E0B37098CD4F12A2139C3C31326E2235936575DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cdad7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5cdad7.TMP
Size 1KB
SHA256 7df993e2e6718033019a766cbca453d75ad591a25270d259f7bb00c934b2d855
MD5 39b08a58f3ff33f951ee2fc0314ef687
SHA1 14f459d850451774911dc99f17f3e537885711c4
SHA512 8d652aa42422b616aece366d82f8d488e3c834c14f4f13591c459c7392fac4414ced49f350f5106a048fe977c2398865378f9663211f2b678b00c03d5697bd12
TLSH
T1B321148A4AD18A0BF984517B0967B8F8737488009721B393A93C627A5D25B8E1B4F0CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 da05141a02521e555874779b1c2116f5870f04efd830e5d08dcf3f8f55e3e0e2
MD5 e9b18c92201fbb5a26effbb9a2c9848c
SHA1 f3cf2140039e154495593b04790507c7d982b65b
SHA512 4465a30e2e263820204df087f6dac185753f33c5855a3fc9c8a7114e0e1cf3ad6979abb447a20aa5cf71f661c7bbf8378ada1517d05d273ef8c6b3caeef02b9e
TLSH
T1B1E068F32DFB1810AD6BC3D65471A4A4410138A8C64CAD8E00AAA2A310B23002806C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 22da6062ae91ff8dd7f057379b06c4112bac32d212aeaa8919da4c6afdd19ac9
MD5 26813767683214d9066c49ac7606bfa3
SHA1 e41e87040a2f26ada3bd9954f5c29401fad2249e
SHA512 9d7d02bd5f28cacac669fe7d484bc54fb2109e1549ed29ff6676ec1de07274e549077ac89f20f038fba1ae512d4487c3440e43595c26cc2cf52b4e3f0df987fa
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQW:E0BFlX
TLSH
T170B1360332B712433C3D2908A299973B4F45F1937424A86B7FA944B25E66E744DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592c27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592c27.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d3491647db6afe55708671407b5657baf8b2d0a98ce50128b07a406c45cd42f6
MD5 082301118d4c6d496164826ead83778a
SHA1 db68b81fbddb6a301a2e44422f7b32e336000f3a
SHA512 8b9de08eda2f020ee03f3f49cec7b5b33d3c568b6a9871fd8fc6176c05ba13db19e8bf66fe003dae11130892dc140497de303377425a739258670ac96db5c1fa
SSDEEP 384:lZcIhsNHG7wyJzAzX5od+KOrgMivt+amop:dhNwaoOzOrgMillmC
TLSH
T16A827C3258786C7658F7E184F94736075FB89067D7CE6EC091EDAB2C00AAA9C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b648d27e67202d51cd344aa6cc9076372639fad450d42a1001d040d5014f54f9
MD5 1c21b70c69875b79bed3db56a1269da3
SHA1 157db6552005b3c8c3c23483b1a728b7800cd698
SHA512 0f3d24dae7160a5c29253eb8c5892d74ae9d7482b76ad71a9f9682e2484f212cbccf99b6cf9a4a0cac58ae3a2176113aaf91b17d6d775660ebf25128d50aa431
SSDEEP 384:+ZcIQsNHD7wyThAzX5od+KOrgMivt+amop:8Q8w+oOzOrgMillmC
TLSH
T192827C3258786C7658F7E184F94636079FB89067D7CE6F8091EDAB2C00AA69C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2b105e7a2cf6946156577d813f8f55907aee719d637c23b33e2b466ebd1c3614
MD5 111981ff1ff45cc03148b68a6d269ceb
SHA1 052f38295fdb74c3dd6e141d9517a0e6ee0ecb3f
SHA512 43a6f216d409c0ba958c9f4427cc2f38d26e1f2f60954bbb34e4e1f023c83e2c5adad3de6856abcb39ece41930d86548faeb8471d8eddd5a9514917c7227f8c6
SSDEEP 384:2iFiZcIqsNZ8TUNTUlIlD7wyWUAzX5od+KOryMivt+amop:dFQqAwgNwEoOzOryMillmC
TLSH
T16DC219F248DB9836D8AE9747E73D2D034E7CC063F5896A90B3985A1CCC561BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 17f378d73a1ed9b71b15fb75459d48c5c302930452ac950428c46babd5af4a1a
MD5 25d2ed6d17f58380c7f09025ffc9839e
SHA1 86602a81c8f4b04ddad3f6e39e82f41daa89bbae
SHA512 84df6a480f32c5f5ecffc30a86214d5549f04b1b980550d7ca6f07a31996b6093adc6fe8c9a846703c37109c6127bc149cd22e49c69cdc587171b4b4ebb0d6f1
SSDEEP 192:yONc61VWQmiUyrugGX5Obd+juOFmI/aN3s5U6:yONc6WzgGX5od+KO6W5U6
TLSH
T10B02E735A8687CA78EF2BE49F58737135FA8207BEA552F84D6E81B1C00D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8266f7d14b48306d263a728e071b28377e6814267a8b857207b5b7b2416098a
MD5 fdce30138c857944fa8f1528754c2e8a
SHA1 c01d7e1a2dd73f0061d00fd07f2b7b443947da0f
SHA512 78b8edaa80f8c02197575113481ec1eae3a39a195bc6179d4cff03c8f9f0ec227293b5dbf159ab8f306b895857019d4d3d82c43d85324509461ea0628d4e9214
SSDEEP 192:QONa61RWQmiUyFugGX5Obd+juOFm0be/jJRqFU6:QONa6q1gGX5od+KOrYMU6
TLSH
T1C412F9326468BC679DE3B544F48732535FA91167EA857FC0D2EC2A2C01EB69C230BC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dcc4d14-314c-472d-afb6-42a81f2e0a64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1dcc4d14-314c-472d-afb6-42a81f2e0a64.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 36468fd55fb9222fcc5c6563bfd9090ed8af7ed1a517ce577e7586ff177d3f2d
MD5 e10389ee474d4b699b877e1b3a6af696
SHA1 fa859918ad0ea2a050e9d0c3479dadfedfd4ec38
SHA512 61a3288503b1072288925d274da998fb7327ec76fe511e29ae83f1bda2760284f6ce7448837940eae36e1bfb162314b2c0f1c1e58d24c2032d9557a303f0ef7e
TLSH
T13F412A5CAAF92148B3B77F465BF2A86D54BFB9372F07945E00010E4F0626A40D971B33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download