hxxps://voltkeybypass[.]pythonanywhere[.]com/

Analysis

user interaction
yes
max time kernel
7s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://voltkeybypass.pythonanywhere.com/
Sample260804-vvmrbsap51

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
924	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{982759EC-CD30-4222-A5B6-3C86E03142B8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2356	1088	msedge.exe	86
PID 1088 wrote to memory of 924	1088	msedge.exe	88
PID 1088 wrote to memory of 4644	1088	msedge.exe	89
PID 1088 wrote to memory of 4644	1088	msedge.exe	89
PID 1088 wrote to memory of 4644	1088	msedge.exe	89
PID 1088 wrote to memory of 2288	1088	msedge.exe	90
PID 1088 wrote to memory of 2288	1088	msedge.exe	90
PID 1088 wrote to memory of 2560	1088	msedge.exe	91
PID 1088 wrote to memory of 2560	1088	msedge.exe	91
PID 1088 wrote to memory of 2560	1088	msedge.exe	91
PID 1088 wrote to memory of 780	1088	msedge.exe	92
PID 1088 wrote to memory of 780	1088	msedge.exe	92
PID 1088 wrote to memory of 780	1088	msedge.exe	92
PID 1088 wrote to memory of 2344	1088	msedge.exe	93
PID 1088 wrote to memory of 1768	1088	msedge.exe	94
PID 1088 wrote to memory of 2344	1088	msedge.exe	93
PID 1088 wrote to memory of 2344	1088	msedge.exe	93
PID 1088 wrote to memory of 1768	1088	msedge.exe	94
PID 1088 wrote to memory of 1768	1088	msedge.exe	94
PID 1088 wrote to memory of 1632	1088	msedge.exe	98
PID 1088 wrote to memory of 1632	1088	msedge.exe	98
PID 1088 wrote to memory of 1632	1088	msedge.exe	98
PID 1088 wrote to memory of 3868	1088	msedge.exe	99
PID 1088 wrote to memory of 3868	1088	msedge.exe	99
PID 1088 wrote to memory of 592	1088	msedge.exe	100
PID 1088 wrote to memory of 592	1088	msedge.exe	100
PID 1088 wrote to memory of 3532	1088	msedge.exe	101
PID 1088 wrote to memory of 3532	1088	msedge.exe	101
PID 1088 wrote to memory of 3532	1088	msedge.exe	101
PID 1088 wrote to memory of 1804	1088	msedge.exe	102
PID 1088 wrote to memory of 1804	1088	msedge.exe	102
PID 1088 wrote to memory of 4292	1088	msedge.exe	104
PID 1088 wrote to memory of 3196	1088	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://voltkeybypass.pythonanywhere.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcbbb9c188,0x7ffcbbb9c194,0x7ffcbbb9c1a0
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,15843080655862001664,12284431200347957310,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:3
  2⤵
  - System Time Discovery
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,1728424451504927502,6608219093835625205,262144 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,7941339571128593330,9722122135252359444,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13963114470184023884,4083512839922560735,2097152 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2393799926279253922,17959318804921405078,2097152 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,6093047793893944656,15840349034298365683,2097152 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,15534958562240515944,1587407078598173189,2097152 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4280,i,17462703434554091224,1924537040449130716,2097152 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,3416096553627948392,11193206468781539285,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11207521837925149403,16442892012113954440,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5960,i,6439046020987316660,9436395643892754742,2097152 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7490539878555415159,3081036727099386812,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,1300992915380682342,18289286218771667494,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,1300992915380682342,18289286218771667494,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,5323834358048420429,1836772689785222168,524288 --field-trial-handle=2612,i,6623409039497657521,12694144950268415335,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 10e097d9c91c5ff3caf4943f063ddb248814916333b20fc4791b29b1c24d2e8d
MD5 132e21fa85085c44431bac3676e74b8a
SHA1 15e7f834e5d2ae3455f3dd783f49e35cfc83aab4
SHA512 35177ea6f78e6b0801ba1b84b0c30b182425a105f7aa792732e65aa491caafa1bbfe43f8220751fb290b81b7296ab8858e3c46888c4a6e80c02976531c324e6b
TLSH
T1ECD023336F59B5D0F2293379E11287412F2A017617C64717B218CC1CDC780C556C5BC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 44f9bb9dd9e546cf271f5f321d2b01507c61b581230d39af71f145b587881dff
MD5 5efc7cc569317d7c9fa6f84f4864b2b2
SHA1 35be796f01aaf40dfc7badb6bdc5c816d6ed0800
SHA512 a695f8600eb55fa1c08b41142236ae111711d308d8d1c35e0be816a0739053a5d4cc69b311fd1cf8cb23108a02ffdab65d8e092e59aa75e42716b1fd99ce28c9
TLSH
T155813B2562FE0B4DF3292272F1D90E1574F3A35B0E97BD9E10988F7C2426B748DE5909
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582fc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582fc5.TMP
Size 3KB
SHA256 862d778fb3ea18545efe1686353c412be089c4afc7f5376af224196848fc37bc
MD5 04fb0992349ff5b2da24f45d3256c4b4
SHA1 a77c16b300d06fd953c2b3170441035d5baf826c
SHA512 fae7a29aeda4ca9acdd212f30d81c47f67d40afb7fd0e3dd3e3425789847e55014d5a91017a938ff856f069e46a2f433d512e70df226b71f78765204d954b4b2
TLSH
T122712A2952FE079DF3262272F1E95A1834F3679B0E937D4E11A88FBC2536B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f391b13-f7d5-4317-baa6-9e033cc47d94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1f391b13-f7d5-4317-baa6-9e033cc47d94.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9e24214bdd0872a23fb7bf63c2e8b5328df38a7767aeaf6881bfb06fcf38478c
MD5 fef3a2736bf72777c20944551a1339da
SHA1 42aae04fe14bb4b316003c52bee6cb32cbee26cc
SHA512 7f4a50f94b835afbd32be3a69699b8c30259f50240b7cf68bd8c3d7e0b4cc6a8179be7cba8f57fc83d504caedb6f99ddf4c90e340da842ee53f140668dd29f56
TLSH
T16E717AF3C3E4863DD91116F4EA186E1BDEA90E6483683D26D9D5AE1B53E6871E200C4E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d26f42c62330e7e780590aab82176b78f602d57994c9b436824b228ca9bd94d3
MD5 9f9551694c941e5ce3b4db3d941fcc9b
SHA1 f3570316a9c1cb4321684e18e684d1519aa3dafe
SHA512 2dcb501fabcb26d65f577b8689c414216e8e2835ac3db3a7c6876d45c109cc46f1a8f1d499f24428a7dfd83d545cae57a3b4017174301a63c0c55e190a061d5e
SSDEEP 192:sxZ1TRAiyM/jK1Ml8+kI/f/sFWpVWubEdpAwZDHW6+WNawp//YQraQGlIgFJ:sxZ1TN0I/f/sFWvWuYlHbr/sv
TLSH
T1B852D702A634697BDCDBD219FA51BB63D6F9147292904E589AFCD91C00E7AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2e0509d27155304806205f50267beb94c2928d64a78259255dc1d35229ff7ccd
MD5 8e381f666ccc621b07d080c4b21cbfbf
SHA1 db476c0d0ccb1b538df4ba0afc4139c3dec28361
SHA512 30330dfd3a202de499548a2339736eced271b345303f22c9f846dac3bbf5e6bbaf27249ab4cf1f46dafe7d4b2a99ad66a484509834723dad229687e49160981c
SSDEEP 768:Ww8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdBroukBUnB:Ww8iJPNWvx76ru1jahALocd6fUB
TLSH
T1E2D20A3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 00b7ee4ad2fbdacfeaad07540e6c35152c906702ab41601e63d42556066b3d67
MD5 a8930c7edf8ed45ed21c25a00bb68021
SHA1 5a2ec86be056ae59688689718748ad97f178060c
SHA512 2e0e7689c87e5d36c3e61510ca0aa23e0ddd7d7854fcae4c0ddaa8ff939747006410616985211e4a3a822092e000d926173f2365ae53fa87dacaf372829ac568
TLSH
T1A6D023D7863159E176306A84D03C154D513E5C4E9C90CDDD94087093247CB03C10A537
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 96d72d24745fe735cd74ec2bd1b280a9de7a3d2e9c982f712cb820bafeaa6cec
MD5 f6ab84f967c871de800b0bade1de9cbc
SHA1 f4922bd533efa8698360b0559d0a61041b677455
SHA512 b999ba3f35523d1c783c867d8b386a36bdfe4c643a86a8c0bb2b65e8d4c2d1a61f6b8f57fda75df99d6a277fb8675977872c3770e6f7ca79d92910222499326e
TLSH
T135C09BD3551146D65674ABC86038735DD51F414C98D0CDE861085543247DE13951A62B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5829ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5829ab.TMP
Size 137B
SHA256 a72d1288ffc8affa0ad66817be394c39ab4c3ba5d847b8c911898f7599ef9799
MD5 540086251a93518c13c33a73133e5b87
SHA1 23bdc4a19f4482aa0af457893bd2b64fdc4d430a
SHA512 c809ee38c749b6435b64607d1dd7729cd36450e17c3fbdcadece902b9a1531e6fc5eb1fc22080b9c07d15362b4d72be8f2c21e3c91c3658c53ddc7338c15e058
TLSH
T18EC02BD340204AC2073066C46038735DC12B4C4C88C0CDE8610C3003303CD03C60D52B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c1d4a4154147799e0ed42ff37950c706bfd84fc8eaa669e58add0128d7999608
MD5 aa8275b13cea5069a4cb9ef38351aab3
SHA1 2b94c124540b04d2a30f6a1d3743f5a1eb1daf55
SHA512 d6cd3cff7e30d1aa87f15c3660902b6c4175dbeff6d072425e31cc71a1750152152f042ef4a62ce351bac3221a876a1cd789974aa8722c348614c0f702bcfa2e
TLSH
T151A002B6256440C0CC1515F09801074813415C204000A25AC8FC05998D60640C193544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582fa6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582fa6.TMP
Size 48B
SHA256 2077bea7e3a8936cddee56d02520b51e692831c1b0440541f77a545c6250345f
MD5 965dbee15a8780567f7667279eef8610
SHA1 f86e2272945d2560722f3ce1eb10ad5771a7735a
SHA512 a6e85cea6c1bfd9fa13a9e94f18f9efd79299bedd1e540773870b30973e62533737ac16b7a97735a8631e8081ee434431186c38a59bb517d6a5411de78b67f7f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c6cecf178de0faca01d697ac749c99bf439abe20d28cb8aca704ec300e0d8e79
MD5 86e8a7db5d5897d072ea911a32e1fe77
SHA1 d1df8992530e38b56e33ddd54655cf2beb6f1b9a
SHA512 cbb6b6c06beea352ea986d424ef6474efb293c97686feb7ed033ea625925bcf108ad372148eec78f88988c1a1473e6843c6dcae0a4cc6dcaadae0679a1f5cbdd
SSDEEP 384:csNWLWT6xREkywmfIT5yAStt81ki96MFj:cY28XUzS7i9hFj
TLSH
T12C825AB0D8A84DE758E2E5C9B646F1232EB80177C98C4E5CE6F5B63D309F5F81712806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8cc124b1dc722ee98ef3105020e15e2cab8dea74e74bdf5b23b8ee643caf758c
MD5 93722474d615c976351de612e180a9ca
SHA1 aafcd19b722ae38b040b330346056283ff696c65
SHA512 7ff2ef86b45ad1343df4783c6cc7178ad6924e71bd7afd18464aa3d3ee1bda6b7ee28fb53f0ded7ef1e60d1d1a3ea28977ca5dee70e76b2874d089d59754aecf
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5R5DyUBhPwivh50xy0SFYKNAxOYc:gONw6kDfQmiUyTyYZ903iow+QiA90oU6
TLSH
T16E02E93568786CBB9EA3AE49F44737275FA9117BEAC52F84DAE81B1C04D725C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc91a109dec1d30d29713c5325a18d4818eb1a29607f6e2d3da9c7e6e715d2fa
MD5 de84857b70c271b926a928301338a802
SHA1 8f51d1a100d0a38195735dda22d238c318ee4c0e
SHA512 15fae1870f3bf93048c9edfbea1ec94aab7d040dea71de98ea4f8a58bf78c9f95c2687c9a08ee0f5e2c3d4c9709e059533603c90ac4b4c74021b74aa2d70571b
SSDEEP 192:MONn6kAQmiUyoyYE903iowmcEJzcRMrqsU6:MONn6hDE9ywmfOeU6
TLSH
T112123A326878AC7B6DE3A945F48736239EA58127DBC96F90D9EC271C05DB29C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a009f10f63bc49ffe9ddc5af08a9a6edf1cd8c2f95b888dcb9023a953bca6142
MD5 120e749b6529130f6a3e57406e639949
SHA1 eb818058d9866c9f28992ef6fb0c216cf9f15463
SHA512 89ce8a88ece313bb11780612409bc7e1165679654a6a41c71fb0e4213278765d1b971b343e22ad15c03c1734f2413b6947ca85914d36328122654e0ded633511
TLSH
T133415F58A6F91148B3777F56ABF6A86D583B78333F06D45D00010E4F0A22F40C962737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads