hxxps://blooketbot[.]schoolcheats[.]net

Analysis

user interaction
yes
max time kernel
1049s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://blooketbot.schoolcheats.net
Sample261002-wvpflaxtdv

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
44	ipinfo.io
45	ipinfo.io
54	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2036	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{8A637578-9E89-48FA-B08A-CA3AC6A061CB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 4952	2936	msedge.exe	85
PID 2936 wrote to memory of 2036	2936	msedge.exe	86
PID 2936 wrote to memory of 2356	2936	msedge.exe	87
PID 2936 wrote to memory of 2356	2936	msedge.exe	87
PID 2936 wrote to memory of 2356	2936	msedge.exe	87
PID 2936 wrote to memory of 3644	2936	msedge.exe	89
PID 2936 wrote to memory of 3644	2936	msedge.exe	89
PID 2936 wrote to memory of 536	2936	msedge.exe	91
PID 2936 wrote to memory of 536	2936	msedge.exe	91
PID 2936 wrote to memory of 536	2936	msedge.exe	91
PID 2936 wrote to memory of 4120	2936	msedge.exe	90
PID 2936 wrote to memory of 4120	2936	msedge.exe	90
PID 2936 wrote to memory of 4120	2936	msedge.exe	90
PID 2936 wrote to memory of 3784	2936	msedge.exe	92
PID 2936 wrote to memory of 3784	2936	msedge.exe	92
PID 2936 wrote to memory of 3784	2936	msedge.exe	92
PID 2936 wrote to memory of 4700	2936	msedge.exe	93
PID 2936 wrote to memory of 4700	2936	msedge.exe	93
PID 2936 wrote to memory of 4700	2936	msedge.exe	93
PID 2936 wrote to memory of 764	2936	msedge.exe	97
PID 2936 wrote to memory of 764	2936	msedge.exe	97
PID 2936 wrote to memory of 764	2936	msedge.exe	97
PID 2936 wrote to memory of 2696	2936	msedge.exe	98
PID 2936 wrote to memory of 3012	2936	msedge.exe	99
PID 2936 wrote to memory of 2696	2936	msedge.exe	98
PID 2936 wrote to memory of 3012	2936	msedge.exe	99
PID 2936 wrote to memory of 2492	2936	msedge.exe	101
PID 2936 wrote to memory of 1968	2936	msedge.exe	113
PID 2936 wrote to memory of 3708	2936	msedge.exe	114
PID 2936 wrote to memory of 3640	2936	msedge.exe	115
PID 2936 wrote to memory of 3740	2936	msedge.exe	124
PID 2936 wrote to memory of 3740	2936	msedge.exe	124
PID 2936 wrote to memory of 1652	2936	msedge.exe	127
PID 2936 wrote to memory of 1652	2936	msedge.exe	127
PID 2936 wrote to memory of 4944	2936	msedge.exe	128
PID 2936 wrote to memory of 4944	2936	msedge.exe	128
PID 2936 wrote to memory of 4944	2936	msedge.exe	128
PID 2936 wrote to memory of 3032	2936	msedge.exe	129
PID 2936 wrote to memory of 3032	2936	msedge.exe	129
PID 2936 wrote to memory of 3032	2936	msedge.exe	129
PID 2936 wrote to memory of 1312	2936	msedge.exe	130
PID 2936 wrote to memory of 1312	2936	msedge.exe	130
PID 2936 wrote to memory of 1312	2936	msedge.exe	130
PID 2936 wrote to memory of 2696	2936	msedge.exe	131
PID 2936 wrote to memory of 60	2936	msedge.exe	132
PID 2936 wrote to memory of 3992	2936	msedge.exe	133
PID 2936 wrote to memory of 60	2936	msedge.exe	132
PID 2936 wrote to memory of 3992	2936	msedge.exe	133
PID 2936 wrote to memory of 4828	2936	msedge.exe	134
PID 2936 wrote to memory of 4828	2936	msedge.exe	134
PID 2936 wrote to memory of 2760	2936	msedge.exe	135
PID 2936 wrote to memory of 2760	2936	msedge.exe	135
PID 2936 wrote to memory of 2884	2936	msedge.exe	136
PID 2936 wrote to memory of 2884	2936	msedge.exe	136
PID 2936 wrote to memory of 2208	2936	msedge.exe	139
PID 2936 wrote to memory of 2208	2936	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://blooketbot.schoolcheats.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x21c,0x23c,0x240,0x220,0x248,0x7ff84e96c188,0x7ff84e96c194,0x7ff84e96c1a0
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4502717327483881443,6911869209218956800,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,5465866031075475734,11697309779028186938,262144 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,14321149391917074165,16344893876046305706,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,381021257151886174,10057118621892828542,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12552929549718951710,2362689119526140021,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,12295612608152708349,246609012085639780,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5720040578474431534,1355196650548356742,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5064,i,9991354347635033217,4288824778177186139,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,4892879991816462514,14135181012636062108,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,10095062147465772761,6424742199571876891,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9338162246890745337,9349645767941716510,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9338162246890745337,9349645767941716510,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,6996292216776206108,11173092188047305099,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,553563688905066389,1076195739703501361,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2378263788202316108,4503804157670851203,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,8445328981591482392,15002707603579622261,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,8092769139702491829,5253856810771453379,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6048,i,2476016603563983565,15223321844084217182,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5476,i,4356400322289362226,3852578083753824961,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6720,i,7952466927834024436,12975634852673649472,2097152 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6892,i,5419195890353391389,9183722451917334643,262144 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,5129746909240572671,17043970646440947085,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,12258047332990720148,13064854877002724907,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,3157158509072311605,12293241566357748281,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3008,i,12542178127068862703,14777090835185246713,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,1511848418893357483,7104201856114549519,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7467676947049774305,5383681056998481451,524288 --field-trial-handle=2292,i,13290030851241776678,17128069837869304457,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

717162af-9b85-4aa8-afe0-13e277d453c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\717162af-9b85-4aa8-afe0-13e277d453c2.tmp
Size 8KB
SHA256 477c518905536bfb8ac43aa89d704779ff545ad74c76a8ff16c13bcc9989e115
MD5 e0e9ed3e6b65bbd2fe36989293d04d69
SHA1 e0acb5e97bb964d104d490ad12ad1cc5a620909f
SHA512 bb9ebd3ee0b8e1485fb19692c4a4cddfd4efae4bb59eafa33a7a82b23a585e0d4481c0c232b10dc38ef4040e64816e07eb7e343292f869b68a5ff0db8ea893ab
SSDEEP 96:KqONk6QsjpfbUUH5ih/cIPURHl8h4otop5/xPD3BKP4v+Y1xf//ojdDxv3ywxxPs:BONK6JULQmiUyZrxso//2yw34NxNqGU6
TLSH
T1B6122935B878BC7B5DE3A581B08336135EA45227EB856F84D6EC2E1C01EF26C5307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8dcc2fb4-794d-4008-b98c-412aa4fdfffa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8dcc2fb4-794d-4008-b98c-412aa4fdfffa.tmp
Size 18KB
SHA256 358ccbe34d98c208f830813b986b39c058f20b53b9b2b5208a1f126da1ed44f8
MD5 5ef1601e941ed92f3bdd68c85fc31d90
SHA1 5ef397b9a52b7fff1f6bb35ac4af3d0f5d52fb9e
SHA512 4ff843dd2ef41bc8b6a822444333890f26548f53155328be9e5b432be477139e4ef4e5da614782903879fce08f6edf916bc7e55e08394d62c97702e5fae1e242
SSDEEP 384:MZcIhsN/x2vsybJFK8h//S3t7tgOIwZOyubIob:ahLvFKQ/S7XsrIE
TLSH
T14D828D329C78ACBB6CFBD180B48737035FB49127A7D46B8495ED5B1D01EA1A8130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d7b045b-3882-4dc0-b3d8-1391c4ec1a7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d7b045b-3882-4dc0-b3d8-1391c4ec1a7e.tmp
Size 8KB
SHA256 a3ff5bcc66768a693f22bc418030eadcea317dc52b351be1e1d7c332a070663f
MD5 07de81ed9b3a68fb5dcd399f5f7217ed
SHA1 7dec0cf5f22a03ba01877184c017e0f8ba037fac
SHA512 9415c14a2f94c412486585a40bb6c1166e8c5dfb339c50f094b574172b1a00097e8d2ca1f3b41c4216ed4bc0f7605aab9ceb6779bddec016bb199937642dd209
SSDEEP 96:KqONkCQsjpfbUmjH5ih/cIPURHl8h4otop5/aD3BKP4v+Y1xf//ojdDxv3ywlBCA:BONy6JUm0QmiUyUxso//2ywlBC6NU6
TLSH
T1B402E839BC687C7B9EF3AE45B48777239FA4106BAA912F84DAD81E1D01D715C1303D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

05f5637d-038f-4588-adc8-ea876285c3e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05f5637d-038f-4588-adc8-ea876285c3e1.tmp
Size 10KB
SHA256 ebeb575ed40dc6aaf0838a025bd0c789c548b1f572b02add1e81c46eb1fc8dcd
MD5 1c64ad8e3a3b6c18265e4c27e31504f6
SHA1 f2eb5a7ffe9c3f7efbc4b47af517dcb203257557
SHA512 992748d18f2e0459375bcf87abd10b8c9aa2efcc95fced69da50057754fcbcc2c05a6d7d5bd444235a29b2573f5539c47b66e93e5c232c93b66ec68410058124
SSDEEP 192:sxZPRlWb/f2stZIdpC3HW6+WNo72A/Y36h+HIg5HJ:sxZPKb/f2styUHbK/XiT
TLSH
T16422B7526E38697B8CCBE20ABA15BF53E2F9613291911E58A6FC861C05F76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

071c2b1b-6992-4ab5-bd1e-3eba708041c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\071c2b1b-6992-4ab5-bd1e-3eba708041c0.tmp
Size 10KB
SHA256 ed53263741055eb4af81a2d8bcc57f73b088159d63bf255a060f4455583dd8e4
MD5 38d223964105e9414b1da9635f7de303
SHA1 88a900e30f0f38369674ae0c65d63b17d1ba8445
SHA512 0e42d35f60692e80907c4c9db5e5d5bd927234c5215ed81778348ca46b3d720eb54525d752c88c34798062d1cf27213c047ab388eaf7c7f625719676d99387ab
SSDEEP 192:sxZPRlWb/f2stZIdpU3HW6+WNo7sDXY36a+HIg5HJ:sxZPKb/f2styuHb7XXVT
TLSH
T1AA22B7526E38697B8CCBD209BA25BF53E2F9613291911E58A6FCCA1C05F76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11d2bc8f-d6cc-429d-b8be-c6f9d29d5264.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11d2bc8f-d6cc-429d-b8be-c6f9d29d5264.tmp
Size 27KB
SHA256 4745bf2e2a42010fb75a3ed73bbd9cc1c33016c8891357fbe4676aad7dcd0e35
MD5 e6c24ab70e360ac8af15ed61c6fdb71e
SHA1 67aa11487dc63a187465f795f2bd189c3e09b5bb
SHA512 a9933e21cf89c70d48641de86cc9c0fa469c39d0d9417c4bb48987f558b897d835117c7ef030db745b478a543a72aaeffb2fd4152fef06d453668653f88d4a4f
SSDEEP 768:DuQ1Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/troVO:y4Klm7QWvUYe0u1ja8/L/E/GVO
TLSH
T18CC2FB3B640CCB7E4FC05A9DDC5A6F9B6EA802C796588D4047FA984C02C77EA51274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2930d71d-7c73-49f4-9400-be21d8a9bf1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2930d71d-7c73-49f4-9400-be21d8a9bf1d.tmp
Size 10KB
SHA256 2e269c5aaca72947a3101da43b70f9165e23f0c422b2caf2931cd07301c7251a
MD5 522293715d86c69132f227e7b3c9b599
SHA1 37a3d03ec2fb9734076c60c804ec051a93e2064b
SHA512 18b76c47eb37973ac46b12373343460deaaf6ffa2f7eab1b0d87c09269321c3fadcc0e06059b58dffe7e450329361562152c171e8f3105bb98d355ae76396cb3
SSDEEP 192:sxZPR0Wb/f2stZIdpU3HW6+WNo71KdY36D+HIg5HJ:sxZPVb/f2styuHbLdXMT
TLSH
T13632C7526E38697B8CCBD209BA25BF53E2F96132A1911E58A6FC861C05F76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

591598d2-1b3d-4f59-bce0-42042af6d2a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\591598d2-1b3d-4f59-bce0-42042af6d2a5.tmp
Size 25KB
SHA256 4bf596d1729cf957a2ae3a898f5cc68abaa3bfa476500e56ddc4510022d769c3
MD5 3840bd1ec42563d9bb5a3e6888275987
SHA1 289a784fa1d1d306ae7a7c9b8df6f5af67275c58
SHA512 e833649c161ace52957bee8637bec30fbf95f6e523f0790fc8dc737b427246f3a9797fdb5bf9581881633ad681a56dbe77f05405aa19641c11a046736d4bb0ea
SSDEEP 384:sxZPVb/f2sr66s8qMpRiYnazAW8pZS15posJWeT+9gyuHbY4XXST:s3Vb/fx4Mnc7WeT+9g3HbYC0
TLSH
T133B2F6059924C87B9EC39D19683C7E33D9EC506222C5CEDE5AECCA1C01AE1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7568e7d6-f0c9-470a-a8fd-7e23c9c3cfd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7568e7d6-f0c9-470a-a8fd-7e23c9c3cfd6.tmp
Size 10KB
SHA256 50b920e7d656dc03535e86694c75d6aefae0b92329b0bd3b6b169a00eb591572
MD5 85be3fc78f2f4900026aac650b424406
SHA1 b4b4158f7f20ac05452b91267be9117e8e344d76
SHA512 c354023e558ca08c8db19213eacf02905f86a55bf4cf385f036aae3181263ed376e2f678f32fc15a355cfae080391183bbc025a92594a1c64c5201aa9f22e955
SSDEEP 192:sxZPRlWb/f2sRZIdpC3HW6+WNo72A/Y36a+HIg5tJ:sxZPKb/f2sRyUHbK/XVd
TLSH
T1CD22C6526E38697B4CCBD20ABA25BF53E2F9613291D11E48A6FC861C05F66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 e83e1de97776ce41f3d428b2a389c92ca15550a16f4269ab57843dc854ebc333
MD5 66d274462da4c0bed992fafcbbec3feb
SHA1 4b447bda1178fbf5792e796ece08ce8c40d38ca4
SHA512 ab11b4e402d272fe948ed9fe0fa2fa47b6d5a52699477f514c41073b73c5460dc4f948b789e3ff610f0d2147d9a3dbaa0515b96c5daa9f496448bd767a4780f7
TLSH
T182E026F506C8CA2EF34868CB11BD530C83C0365B92C06E8F9B04C988740A0D4B3E67A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0968104683264e808c0924146dc3aa7d2f9f33adb4a566ebf33967db39c9200b
MD5 422e5f612a36a782bc89fe36a3c6b44b
SHA1 637dce8c5e2e360d76ad48368eeced3caa611976
SHA512 154b3c91e2b929efd0e67e9a52bf3c48e607897d0156bf02abd5eb9fd3292a86ea878cbf4b63fcbb7f016b716d32e57db0eb184671eb8933237414a69e80b33a
TLSH
T157E0DFE486C8C32EA24868D70278630DC2A0365B9AC8AD0B7788C68C7405648A7A66B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 965cdf4ec22e77cc600d7fa9eda4b1276797a00c19c2408523d3194736115266
MD5 bafb94baca2dcf246648d6bab3e0bdf3
SHA1 2bbd833635f2e87b8a047e6e375d140d89d8aaa9
SHA512 1d9f1aedf79df32348f185f560d5896c25f295a334f70ef9d92d5a1d022dd0e67793c3453ac80807c93fa5a8f8dc5495a5778ce9513e383af19fad248d314815
TLSH
T14EE026E447CEC22EB358A587227C534C8380B65FD2C8A90F6700C5C97C46040E386BE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f9a30c95e27b527c8a39c8689ccf13f1c792ac915ec94727053fe6bac1d4313a
MD5 bc4099d3ab770ae195567c7b78489c07
SHA1 eddc972acad97d10112f4315308699959d227025
SHA512 30988cb81fc31d7b8fa2f0b4eae405e34b5fe5d0915380f2c8c883c6d06e47bb87cee91d065d9ccca43e91f483c16d9712812c19438c8f416a461eed05f21cab
TLSH
T1E7E026E40ACCC22EF268B897117C634CC780376F93C0691F1B04C58C7445988A7A67B1
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 24KB
SHA256 d549ee737a59e33cef9f7b2b4069849b4814c54752d9c73c9f7e54eaf5c14a4c
MD5 19a7bf4559b0e74112911f8d66cce5d0
SHA1 cae587a5587d9e659896c356b63888a38306f65a
SHA512 40f9a9dcac4cfaea8c1205cb948fce0ce7d59f345104eda0cd21ca312d2794a99d3032c5ca43389ea249e74584e10d301a2f1ae4f6a05fb069d4fc5689edfbcc
SSDEEP 384:xNL7J77MRAHRH7V6n5XaPRWvHT7tfEVR2Cp8rfRCmgbL2IR1QNancIuzdzLA0Xgb:xBR7McRbkn5j12gCp8TCcNacI6xBgke
TLSH
T10DB2F18486064C9BFAE7E74D12C7CC57D92485D32F9EE60E6204EFF3E9D64D6260A903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 73KB
SHA256 a7fc83bde2252b62c2b604aaa7f74c0a67031530bde06b6c3f25a02376e461a1
MD5 515c10fce5b1ed9e6d4a650f2d5cfb06
SHA1 bb75685c813309a1f0e69d3011742d702bc54fe2
SHA512 47c061d4dc11fed95f372ed7df1b769d67a42641de8ea270201e4523fa5979e96a090a8d8c27ca9d815a126a8535d55a4ddee6b9fa5b2bef2659222bdbf3540a
SSDEEP 1536:UWYPGdLXUtyHPYNvx8+MOcYsbEvJ5tq84z/521A3TrJB9v64:UDU9HPevCfzE7tGDrT9v5
TLSH
T1B573128AC3195B99B0C286BD5556884FA0F8BDF4C1CC50CB8901D4FCB5B7E856BEAF90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 9131cbf1ff80f9f08a1cc72c28860351aeed1a1720068ea65757a2df02a19bd9
MD5 45922e96d05e97fb5d1053a9ed33b3b0
SHA1 df5ad62b3425efc3154b3dbe977a8e6c3f54553e
SHA512 5d67891ddebe99b39f9b53e46c9c48421e877c05325675b45bd5bd0e9d9a2c31c6b4500b5aa05d8c193918ea0ae38fdcc3e96d46f523f761e4538b0a66d17a71
TLSH
T1FF51A5C816A043D0FBAC98F409C5A48736BC2EB559436D3139D7DE71FB66359716D080
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e67ead9c029663fec779aa7b487f4a637a6c55d8142329424664c67e8b5d7ebb
MD5 b041337c9774d3e57746673d33c48c1a
SHA1 866194507bf2626f43087e752352483c81b3c15e
SHA512 31975b3512612dd37d7ae97fd8c0d1e0baba02ab66a01deaaf3a0eb2583bd31afc20f182084edf7bbbeca7500cd06597bf2e014e93d5e30ce9d22d0b72b01053
TLSH
T1CD8189C527A003E0FBA85CF05BE554C73E782EA915431D3229E6CA76FE6339570AC980
MD5 SHA1 SHA512 TLSH

Submit Download

ce0d6f09-eab4-4ee8-9832-4118420f7ffc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ce0d6f09-eab4-4ee8-9832-4118420f7ffc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

09c7a7fe-25d8-4163-acdc-9393e4f39c9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\09c7a7fe-25d8-4163-acdc-9393e4f39c9f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

33b71a6d-84d6-4bc1-9f59-64ed2242f61b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\33b71a6d-84d6-4bc1-9f59-64ed2242f61b.tmp
Size 13KB
SHA256 d6d68addc1580509a92c73e7df3e3c0de0b1e3c76936ef65c1fe98b7dcb0bb6d
MD5 3578ce981e7f554e4202a7f796c98a9a
SHA1 be68b645691ebfd99efa0dae6aacd4005a96957f
SHA512 69017c8adcdf4d699925ec76ec3aaf03a81b0f06ca385b694e67e69feb9a1ce4de44857e64771e0b66dd92e5b3f96c11ac6cf77f4c3eee6da10fefafe2cbb525
SSDEEP 384:DWKQ4re+BUh1UtkgNeqPaJGoBeWeXmJMJQ1WClk/3UG7Rqa7S2YSMceeRfhnvpK8:oF5ODcmk+5rxRNeX8
TLSH
T1C65270F783E8CE7EEA1163F4A7146E2BCD5C0919067C3C6A89D9AE5BE3D1030D24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66709cd8-d607-4340-adb7-73ce1121d351.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\66709cd8-d607-4340-adb7-73ce1121d351.tmp
Size 14KB
SHA256 164c192036b9faafc8dcfcc3ba07baa43a03bdeeb3337e650b45ddc4b1297adc
MD5 31203cd202ce7e5d71e0b9d803011015
SHA1 8c94857f6a9b11bb35a4faf1e337b3d1722790de
SHA512 c3471c2930ba55860bdf11933fe51b52e73bd616bf804ff6122e054cfd4dd9420070a69c153b17a322b826158cd4f7bfbc769041c50cec3df388ab94232c08a8
SSDEEP 384:Dm2wdBeQcew1UtkgNeqPaJGoBeWeXmJMf1WClk/3U47R4atS2YS1ckeRRhnvpKAO:3F5O8KRk+5rxRNY9
TLSH
T162529FF783E8CE6EEA1123F4A7146E2BCD5C0D19067C3C2A89D9AE5BE3D1430D24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ae0add6-c7ab-410b-ae7b-d4a48b299f6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7ae0add6-c7ab-410b-ae7b-d4a48b299f6b.tmp
Size 6KB
SHA256 ffc84d3c6bc03a587f796648baf88798da45ceae299d0073a626c7bc3750dd2e
MD5 07161ca4f02883c40d5db855895abbf9
SHA1 959665379b8de3b6d447287f41c530164b618618
SHA512 671eba951efd8272b82531949b21901d51fef66829e3908b6993144f0ae1a94a66025b77c866fea6ea83c5d70b5c69c0777872bdf54d12ba8e796741136559e6
SSDEEP 192:Dm2wrJBeQcem1WClkZCqO3Upa07ob8ywagDDGkTV:Dm2wdBeQcem1WClkZlO3Upv7ob8ywagH
TLSH
T13DD19FF7C2E8CE6DEA0163F4A7146E2BCE5C0915467C382B88D99E5BE7D2430E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2b0d586-8da1-4f39-b342-915ff0961d05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f2b0d586-8da1-4f39-b342-915ff0961d05.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\temp-index
Size 72B
SHA256 4861939c3f62cb66fd716d668a036681504a1a4ee5e7b0d38bd4a9c10399995f
MD5 e3717dfdb8812b305cf7218ddfbf3dee
SHA1 3bf818f928bfc6019087a2c51520dfc5be19cdea
SHA512 72ebff39782e445351029a01692934d98d8e151568132b791d2ca8b72cdf98861a885eef523a41533422a298302c594978b07729c19079494263608dc283b27d
TLSH
T119A0021703894901E50319B0675603931311CE1A0304271B85934055EDE44594EB170C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index
Size 72B
SHA256 133968ae534c740b1fd882650fee43305db085fbb51400d91ef125d1221a5c55
MD5 a0fde51cf18995241124fcd2ea2a8a2a
SHA1 f0041886f3c7f666fd4d381918d99faae036f6ac
SHA512 4ee4a622d197e71264687406570a5d3a51237757637218295deeeeef2f07b142dce7ad0f2b0945c9b516d7f08f3c49c1324197d664f44be90019d2cf2417ba4e
TLSH
T1BCA00219038D310AE82A12B1155602995351CC541208671BA4925255CD915524DD100E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 273B
SHA256 adb3a935bc17a53592c785c66c9c5b519713a4952f40b84a92bbffbb9f5533af
MD5 449326dffdd805dd7b81c029322b339f
SHA1 807b4933c22a88918963b3ad638d980b680ff6bd
SHA512 417c7f1f606dd3a4de5ad67926f80e9a55a988fa1d4c642ba996f76a18cb78e8108ef41f660c613336aa58c7d72dd7b8db0eb01972a4b9e20de252a71e5a6831
TLSH
T1C3D02BB62D755410DCBFE7D6103268A00010B894D959FC5E552C89971463715B41AD21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 332a77388e2cefa336a62f8a85a37bb451b1dc44b898125d018eda3090bc24e1
MD5 cc54899598aa542294b4da3253497394
SHA1 5cca2cdea7145d5fb8b8ed8953cd7b6807d802f0
SHA512 bb5c12436e2c4e08dd77aff6a51655deee50e97332d29406841be1178e46b704ca8efff82b74250f282d13e56be4ed907ea3123fb4bdbca5346f3b6e360fda0d
SSDEEP 48:K0BQ9xbfj8bP6nISJ8K9p1D8xhsYarhhyL6lI064I5bkjUISs5K9Q1K5xipYb88l:KUuQKTS2OJWKK0BByKy0yKt
TLSH
T18391430135B74241387F6A4C46B48A1B466571F23014E92BBFBC41E6DEEEE045EFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a657a972-9111-466c-9ca2-492796ed49fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a657a972-9111-466c-9ca2-492796ed49fa.tmp
Size 10KB
SHA256 ea1304b593317ae1166133d89149ed72d2a619b6fb39eabb42ed1af33a17daad
MD5 29eab16dcfd98df82845f26cbca7ae92
SHA1 29b34247d4742c2c1dd659469bb2be567b8d4344
SHA512 a2675c019aa088f4d8c6eec6a46797603a4524f0405c25f052049154d15b559335a4d647d78aeec3f2726ba93375d31708fec5701ee7a492f71b73cbb7908be5
SSDEEP 192:sxZPRlWb/f2suZIdpC3HW6+WNo72A/Y36a+HIgrJ:sxZPKb/f2suyUHbK/XV9
TLSH
T1B322C7526E38697B4CCBD20ABA25BF53E2F9613291D11E58A6FC861C05F76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c29fffc8-a214-4c06-a1eb-433e8eb1d12d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c29fffc8-a214-4c06-a1eb-433e8eb1d12d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faaf816c-e4fa-4b22-99e8-68988d288e45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\faaf816c-e4fa-4b22-99e8-68988d288e45.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5b1f1557-449d-4c73-a13e-00243aba45ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5b1f1557-449d-4c73-a13e-00243aba45ed.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dafada71-1ba1-41ef-8a91-83eaf71811c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dafada71-1ba1-41ef-8a91-83eaf71811c2.tmp
Size 18KB
SHA256 76e6a36768fdef2a7c032f4f4fd19285f7db2b8c28b2d31cc4fddb27e97b888e
MD5 40973066801f2c3e59ce5c4fe9d534f7
SHA1 7fbb31573680d9d718a9dc24c86b708e29c233b3
SHA512 74aba16869a5ce8901156fdc88f65afab97526dc8399aaacd89a0547e0bada8bd77a71bd39051e6d266e8c62166100982cdc6841409aff45fe9b7be12ed3775c
SSDEEP 384:kZcIhsN/I2vsybJFK8h//S3t7tgOIwZOyubIob:ChQvFKQ/S7XsrIE
TLSH
T18B828D329C78ACBB6CFBD180B58737035EB49127A7D46F8495ED9B1D01EA1A8130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea4e908b-84ce-4fa3-a57b-74cac15623e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea4e908b-84ce-4fa3-a57b-74cac15623e6.tmp
Size 26KB
SHA256 c308b3fa1a2dff5142bcdeb5799ee9f747f3b474ee0f269c1647c289521451e4
MD5 818f5055379e7a20d40a0c0a1722d347
SHA1 7ee6779e43d8379d2af430cba969af7bdaba774c
SHA512 209d2178aca6c281c6d49a2f737aec2fbb3e34f0770f21b51ec902e0f046fd6ddf1dca018b9de43dda65f6301d4a24169e33655d935db126abada201fddfd757
SSDEEP 384:piFiZcIMzsNh8TUNTUlIlI2vsybJFh8h//S3p7tgOIwZOyubIob:AFQwswgfvFhQ/o7XsrIE
TLSH
T1DEC207F248E7987AD9AE8743A77E2E034E7CC163B580A690B7D8561CCC961BFC307811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

939f0932-a0a2-4b4a-82ad-ba61b89a39f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\939f0932-a0a2-4b4a-82ad-ba61b89a39f2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 693d3eb90d4ea7179826eb358ef1935d4bf0bda459771842af68f04dd6f1fd4d
MD5 de4cfb9fa80861161d41f04c5f6baf1c
SHA1 2f8eec1437cb6397ed15389967b0bba206149511
SHA512 5121cdde65fca898413d568a82db275b143f1017ed3cf8ea8a3c7a1404c2739b4a3096b7aaa9fe6e4af8185c11e3e2d74df8d687fff33811c023fa9caa288104
TLSH
T16C41279CB6F91148B3B37E5AAFF6A86D047EB9772E47C06D10110E4E4A27740C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download