hxxp://bypass[.]vip

Analysis

user interaction
yes
max time kernel
1049s
max time network
1024s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bypass.vip
Sample260809-ya4e5avbjh

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
120	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	1244	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307777619448870"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{A5A35F5D-656A-43F4-92E7-A15CE07CC665}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 4492	452	msedge.exe	83
PID 452 wrote to memory of 1244	452	msedge.exe	84
PID 452 wrote to memory of 2140	452	msedge.exe	85
PID 452 wrote to memory of 2140	452	msedge.exe	85
PID 452 wrote to memory of 2140	452	msedge.exe	85
PID 452 wrote to memory of 4076	452	msedge.exe	86
PID 452 wrote to memory of 4076	452	msedge.exe	86
PID 452 wrote to memory of 4380	452	msedge.exe	87
PID 452 wrote to memory of 4380	452	msedge.exe	87
PID 452 wrote to memory of 4380	452	msedge.exe	87
PID 452 wrote to memory of 4892	452	msedge.exe	88
PID 452 wrote to memory of 4892	452	msedge.exe	88
PID 452 wrote to memory of 4892	452	msedge.exe	88
PID 452 wrote to memory of 4012	452	msedge.exe	90
PID 452 wrote to memory of 4904	452	msedge.exe	91
PID 452 wrote to memory of 4012	452	msedge.exe	90
PID 452 wrote to memory of 4012	452	msedge.exe	90
PID 452 wrote to memory of 4904	452	msedge.exe	91
PID 452 wrote to memory of 4904	452	msedge.exe	91
PID 452 wrote to memory of 2172	452	msedge.exe	96
PID 452 wrote to memory of 2172	452	msedge.exe	96
PID 452 wrote to memory of 2172	452	msedge.exe	96
PID 452 wrote to memory of 3032	452	msedge.exe	97
PID 452 wrote to memory of 2124	452	msedge.exe	98
PID 452 wrote to memory of 3032	452	msedge.exe	97
PID 452 wrote to memory of 2124	452	msedge.exe	98
PID 452 wrote to memory of 3372	452	msedge.exe	100
PID 452 wrote to memory of 2864	452	msedge.exe	101
PID 452 wrote to memory of 2864	452	msedge.exe	101
PID 452 wrote to memory of 2864	452	msedge.exe	101
PID 452 wrote to memory of 1580	452	msedge.exe	102
PID 452 wrote to memory of 1580	452	msedge.exe	102
PID 452 wrote to memory of 1580	452	msedge.exe	102
PID 452 wrote to memory of 2900	452	msedge.exe	103
PID 452 wrote to memory of 2900	452	msedge.exe	103
PID 452 wrote to memory of 2900	452	msedge.exe	103
PID 452 wrote to memory of 2636	452	msedge.exe	104
PID 452 wrote to memory of 2636	452	msedge.exe	104
PID 452 wrote to memory of 2636	452	msedge.exe	104
PID 452 wrote to memory of 4380	452	msedge.exe	105
PID 452 wrote to memory of 4380	452	msedge.exe	105
PID 452 wrote to memory of 4380	452	msedge.exe	105
PID 452 wrote to memory of 1204	452	msedge.exe	106
PID 452 wrote to memory of 1204	452	msedge.exe	106
PID 452 wrote to memory of 3156	452	msedge.exe	107
PID 452 wrote to memory of 3156	452	msedge.exe	107
PID 452 wrote to memory of 3156	452	msedge.exe	107
PID 452 wrote to memory of 2556	452	msedge.exe	108
PID 452 wrote to memory of 2556	452	msedge.exe	108
PID 452 wrote to memory of 2556	452	msedge.exe	108
PID 452 wrote to memory of 400	452	msedge.exe	109
PID 452 wrote to memory of 400	452	msedge.exe	109
PID 452 wrote to memory of 4908	452	msedge.exe	110
PID 452 wrote to memory of 4908	452	msedge.exe	110
PID 452 wrote to memory of 4908	452	msedge.exe	110
PID 452 wrote to memory of 1724	452	msedge.exe	113
PID 452 wrote to memory of 3720	452	msedge.exe	114
PID 452 wrote to memory of 1864	452	msedge.exe	115
PID 452 wrote to memory of 1284	452	msedge.exe	122
PID 452 wrote to memory of 1284	452	msedge.exe	122
PID 452 wrote to memory of 1608	452	msedge.exe	123
PID 452 wrote to memory of 1720	452	msedge.exe	124
PID 452 wrote to memory of 1720	452	msedge.exe	124
PID 452 wrote to memory of 3520	452	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bypass.vip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7fff0b9bc188,0x7fff0b9bc194,0x7fff0b9bc1a0
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,7060088556523369820,7820045413384163123,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,7731962581358435231,5067447212965097731,262144 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,239549481174031,10108086488138609564,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10094016576252171307,3265867194578772517,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1600865408420302109,13204902334195661576,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,9300559082725408115,13331537923484090029,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,14862119023551723976,6569427432042619951,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5152,i,1232679679237084151,3462675449924334702,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,7098807532928705522,6442138690154846335,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,5054873213626734212,3303681134547808736,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,2130850939291737979,17469386187252447559,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,2130850939291737979,17469386187252447559,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5976,i,2484349180421491799,12727597427048339197,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6124,i,3232325262423541636,11562847190630753439,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5272,i,4267896125413437314,15515222078927629411,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6664,i,5389592759435588561,5847529867408896724,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6116,i,2915157765158413692,11761637168554772970,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,2324174948302032014,9680682211234479188,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6864,i,16747191061888742534,18286497396436031593,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7052,i,15688365445555303398,9024787710368537873,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,3744845822159409185,17632907906632338831,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7316,i,299892203393667303,1233963556459160673,2097152 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,16626957927293656354,3930408379134864,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,6484194653719020236,9209468607505255727,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,15712585953104480634,6172056394886736663,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,15348083670198471471,10790178195810672818,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,9101372313798602587,14636351353046034627,262144 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,12217978177810200787,17961485311564680611,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,1827526999830376058,17827575556275304895,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11425916877575372555,3887023750855285990,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,11801319301511607643,17228433154078229625,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,11742511005994137772,3866042853623955322,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,6110179300777721714,13161854126976079052,524288 --field-trial-handle=2340,i,7432470261120166932,4564727828014228515,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 8b3c9770800d8de032fc8cfc03354870c8740c112827f242ca75872bf85b2c26
MD5 e1f65d058515aebe64e1f24f43be4d39
SHA1 d063f6b994ecd81e2c4f9c5c231890147b0d4f49
SHA512 6ef6206e4d98810fe0e3df5efddace2260a4f29555ba806c3317e37b749f2c93fc676e2dedeb05faceb29e0a4583e325994291f469638c971aaf6202a624dc25
SSDEEP 96:RmJjcmJZmJqmJTmJOmJJmJJmJimJ9mJELmJrmJSmJtmJtmJkmJkmJkmJwzkmJwzg:8jlEHi7UUf4RavIItttqtqtjuwLO
TLSH
T17CA1686B86D4C79ECF06518B4AA0525C40B1370DEFDCD908438CCDEA768E4AFB5E1AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 375f53d0db530911a04b61bee9eac51722de0716d5e6fed62d0906d9c4028bd9
MD5 a044200e9dff324eb828a75831af1c45
SHA1 afb02ff0788a933cfe25ac2e72ec2f4226a74979
SHA512 baa5ac313671dee8d848522d14c8d84660d9c7593b4d0f77debe23f1b283d82f7fa0495d25f94c29940d2aa66b89c5d72b53f08d869f255e655d8a8307ccc589
SSDEEP 96:YmJjemJxmJcmJemJhmJhmJYmJqmJKmJ9mJ9mJ9mJkmJkmJkmJnmJnmJemJemJ3if:xjrclrssxHn444tttGGrrPPZLO
TLSH
T16DA16A4782D5C7AADF0511CB49A0925C90B0370EEFDCE508078D9DDD328E4AEF5E6AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 21KB
SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
MD5 484fcc38f9b75715d8be172de22421be
SHA1 08855b74ef006dc76b4163c833f40451e11a36de
SHA512 806be7ca2beb27ec54d30a2142f3b89abda341e703c335f3c0096c0b8e4160388d5841e71e6f9f0eab53a70a1fc0f6fe6933ba3fa0970a20d5a835259b252e31
SSDEEP 384:SNscoqwsdhvFdy7BDe9pk88eVL7MFEQpwsioMQuSmPTHefTSoNpLg:bTelvABDe9pk8zVLgEQyHvvbHerZNhg
TLSH
T164A2D122B93C414615F2C3E4334F82CBAD84D826EECE767F49EA93901D8C6AB535D457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 51KB
SHA256 c35135cb4e8e6a4d1c9cc60ff9b0e8fb23d5568cc69272ee6df455afef52e2a1
MD5 529b5adccd0797228915db17b3ed99ca
SHA1 78b4c38dc561a81c96a05912a28f22b4a22e1866
SHA512 53ab629b320f633dc9bcbcbd71284c0b8c36767beae6fb6e4e83171d226de9c88347787e0cb93d263704faec7465189c3913c112f6afae39d4bb0e8cb12276b1
SSDEEP 1536:13HtckVrCyymEspIQVRwc1NBCdRnF8SVWCD:1ik/pIQ/13BMWCD
TLSH
T12E33018BB1D4E43BD8A5A5FDA39DAC2ACD8282C58ADCEE335300164D033FC73E695915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 51KB
SHA256 8e95246891091131d753fb3af619af7404a96b8f0f251a4f1178a0f5df99fdcc
MD5 1dc2969f93ccfdc026d8a2f7926d503c
SHA1 223dce52d5a4561c58ee8a1540bb26c3fa1fa73c
SHA512 571f95958fd6859da85d3b5109c52ff49fee20f4d3236a2342f3f39e8621b508a063103b0227ad51e22dc09e0d9a540c886cd6ec3c31a189798e4ed8588bedbd
SSDEEP 768:zh3HtckmdrGW9JfmZEQaENVN03x1gikZbBryGtho1CMWYufNrvvaPGSz2E5Ylw6:l3HtckqrG6fEHVkXO8Yo14fpSVz20CD
TLSH
T19133F2CCFB99D616E5753CB3259928018BD800AC03E9CCA95705AE8CA33FB378AC7355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a7da1e1e333220286f6a62811c9bd46947b70793b3f217a8b199211b3bd94648
MD5 638ef68e200d9d3b2dfdb4144c263dbc
SHA1 540140c9da1c118747b15d34023456fcf92c79e6
SHA512 f6f6bdfd1284db26e4c889cef056f83aae3243ca57d5655d6765f5207daf7b85f98e54ee5f23e6426f4c1b2da03bf630e59f458f1df6c69bfba7d62cf4017956
SSDEEP 96:I4UBC5l4IofCUHXNPSq5+5SjEgktAf+aom:IbBC5lQX4qYMts8Sm
TLSH
T11EA1A838398E00DADB9021BF22F117857534EED3FDDB7F5613D86CB9690E7A28642660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f8a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f8a3.TMP
Size 3KB
SHA256 4fcb75839ca5a10e438b81ef025095783a2c886e702da8e734f8ba11833ebd2a
MD5 b2feb2914c99cfb261841cf60f8a3abb
SHA1 cffc73d68456b76fd0cbb0fc9d7b55f115256981
SHA512 f57472496864999468c67188e1ecc35ea70eb82d1b70e39ef67b46db36dbae8b91af8962699f24d885f7c22e2dc2194b5ace91a04275aa58caa395e98c673cfd
TLSH
T1EE71723D3A0F005ADBE521BF64F213847130CAC4FDDF7FA213D8A479A61EB618682648
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 38163cd54bc93da50bf23199e1f66a89046bb208366239f11567cdd2da984119
MD5 49c91fee3c65d56aca9714ca1c661dfb
SHA1 e93b3e1f58cc9f3ecc90071e4a34754d72d7a528
SHA512 4f16c53b1f02d6447d8ac5af35e97ffa5adc18043ea22e08f01319fc97df249500a655b086933cf67e8c74246bfdb35f24c8e9f0f8e6b46a247e58ce61d2805c
SSDEEP 384:DCtG+pyM36+RJPeEJ4BeKuWrChe4JgxZUgCytMvW+BD0CEPeGZGeI2fHYvORJW1i:85CZSBWBJIMPc/G
TLSH
T1E2626DF6C7E4473D9D5126F06A64AE2FCD1A092447183D26CAE99E4BD3F2031E162B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 8880c3cce24c7853c6f287dbda0d35bc33dddf7596d2bc3d8b171a208158a822
MD5 29789f2b73497764099a3fd3269c3b60
SHA1 3b9956639cdc91a53542d7290c811a4cd1358c63
SHA512 3108f53e6eb05da5b968e09242da8ba4bb3e7d6fcf884c0ecc1e3a5445449114394eeeb51a49096376d4c2fde10d52a6550f2e506b106ad572d8ad9ec11a1dc5
SSDEEP 192:DWB2W5C8ZLSJ8egJ4BeiqzMezJXJn7wwkIJk5UJyRMvI+BI0qZPzZGeCjfgzK4OA:DWB2W5C8ZLSJ8egJ4BeiqzMezJ5n7wwq
TLSH
T1373228FA47E4977D9E5152F06A14EE2FCD1A0824471C3936CAE85E47D3E3032E162B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 1d93894c7694bf47cdbfcc05a5ee55f658c8317f04118c66d19b9730fb813ac7
MD5 338504c6fcda2ef53af3dbf3e3779692
SHA1 992b6e27957858d741d4f18913e9664a04317695
SHA512 9d6c80c130b3fa22371da11658caa6718b4f9cd034fcbd0299c548b0b123f77dff34aef9ce79668354da76d0b088b607ce44413653d62b2f2981508290194dac
SSDEEP 192:DWB2W5C8ZLSJ8egJ4BeiqzRJMezJXJn7wwkIJkj3RMvI+BI0qZPzZGeCjfgzK4O5:DWB2W5C8ZLSJ8egJ4Beiqz/MezJ5n7wO
TLSH
T1DF3229FA47E4977D9D5152F06A14EE2FCD1A0824471C3936CAE85E47D3E3032E162B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a9698c6243a3439418ffbc4c5d1fd4497293bfeb131ebfab9cc4c412c7ebc656
MD5 5472e2f68b6b4f0782365dde53ba74c0
SHA1 f96e99708a1709f19b1c0c4e2fff80c1ac0b42f8
SHA512 1642d91fa0d34cdf5d0ca7f3c4cf2cea496c12d8f26a0648e5ba031e1425ba5da9f2c3445d426572a17390a465aa57398a77af278ca41f7a7a764ea069db310d
SSDEEP 192:sxZMXxRNyM/jK1Ml8UQw9I/fds+KCXDleIYuVop+xBLnOHW6+WNvUEe9bYrhZ3sK:sxZMnqGI/fds+HXDCH+HOHbv2bSeCZ
TLSH
T15862D412AA346977CCCBD209B945BF63D6F51422D2900E54AAFC9A1C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e7a04f736b8cdb408b2f484e29aecfd112db0cff0e652ca8a33a43401b6d3f10
MD5 2d201bc4d288c80038af0dd9b0bbc6ed
SHA1 a39bddaba47587fe59edf62ce27f0c4282ed7187
SHA512 1532743be352ddd743ce122bf2837cd25ef92e35cb0e553c5f5c99ff1848324bb35086d30e3130521566fab4a6b6997ab4fe01144613199b74bde26c1bc36d34
SSDEEP 192:sxZMARNyM/jK1Ml8MkI/fdsZKCDDleIdpgxBLnOHW6+WNvUEJIm/YrFZYsfaIgrJ:sxZ91MI/fdsZHDDNgHOHbv35/mHC9
TLSH
T1E052E812AA34A977CCCBD209B941BF53D6F91472D2940E54AAFCD91C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 04eb4c5a341ac19f2628e5f185c0ef02da0a19ccfb32e2c6940a5d34e81fe9f7
MD5 f0505c07109f451cbd0b4fbf723e0f58
SHA1 19e8a57113177123e567a1402256f5b7b2e7488b
SHA512 2b5936d212693f21ef19770fafe0466e1ba8900aa5eddc42886b95006c708384e100eb7b9a744e19bd78612a8d50710fd22dc9d5ede5145bfccb1a730fd3438a
SSDEEP 192:sxZMXxRNyM/jK1Ml8M9I/fds+KCDDleIYuVopgxBLnOHW6+WNvUEVzZsXYrTYZ8T:sxZMn1I/fds+HDDCHgHOHbvOXLfCn
TLSH
T17E52E712AA346977CCDBD209FA45BF53D6F90422D2940E54AAFCDA1C00E7BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f24ad234ec6253069b87508814ab18a3f57eb2626a39c36e8cfed77f97ce236f
MD5 b2385707ea177f2c7212247c359db925
SHA1 0b8d1c519bdcf05896f15ad15f6ab139f31e6f44
SHA512 bc77b540f4b3748c3008a0ab8c277390801f09f4b57287c03b5d68f2ce66c9197b011f83ff0c76840c852aac7968d5ebf5d5f9bd42b14354662e3f89240dd926
SSDEEP 768:EtgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRiroWZuTdG3:EtgL6XeWviSZqu1jaSJL7+R5WcG3
TLSH
T1DAD20A3B680CCB7E4F840E5CED26AF976DE801CB5B984D5447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ffe87651-8547-4266-b4fb-6f13d3208054\index-dir\temp-index
Size 1KB
SHA256 58c62679a26c31ac8a89c8f4694836d8fc8d0e31ed85593c927b97e1c263a43e
MD5 330d237e9109b7e6d972f83a9499ba0a
SHA1 7503c7e882b101fa625500fa5b8ea006d4cc0e16
SHA512 99616f743cda397d4c324df8267dc040d10657bb5cd440838f8ac892cced35aec257ff8028307b599db4dcca35176eafdc584ca4b37fe96d4cff54d7433dc6a5
TLSH
T135212D899E90890FF85549B715B2B8A473708ACC9728E663283C22721E2278D2A5B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf9c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ffe87651-8547-4266-b4fb-6f13d3208054\index-dir\the-real-index~RFe5cf9c9.TMP
Size 1KB
SHA256 d4f50390bf55589932e6acd2108c623c9a2d1e94b1c3ac6c68250402190f66ef
MD5 6f74462835009f97276a69870e6be554
SHA1 f7b850c55dd1d16f0bead0836326a578eb2f772d
SHA512 4c0f566946b23286acfc628d44f9382817f397b5204c396b1eb2734d7e55ba19bb63c5d937135702c2b16c5d506fd92fc4d4000e3c1f23fa3f79fe968d8c2536
TLSH
T12E2104864AD54E1FF884517B1967F8F4B3319D005326B393693D22794E25BCE1E4B0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 23bdfba2a7a66f560fca055a0b26ed924ff1b07fa38046db8bec955106a23233
MD5 c98f589ad228f3f910632d908b0bf0cd
SHA1 67ef657a3325c9e04d44093f3ac8331068b4a214
SHA512 7f3fe78671cca9459fe3f3280baa5856579f7bb284556f41ee6548f2b5393ddf85566832b831035ac6139cab3507bdd8345fd6a065ce405c9814a7db55abd29a
TLSH
T143E068F32CDB0820A8BFD3E628320CA481117984C448FD4E1025928312B2329245EC71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3511480c2c694a4d067cc63aec32b44a0581636eaeb5729a4207907c35e70e65
MD5 6610748db2586613c3ebbabf4a63b3e0
SHA1 bd1840912264431f1afa6a5e8805745c766b0809
SHA512 0a8f0d78c0df0afa18c9d025035d8cbc49da5f4ec706750c8cc506edcf1d25f5fa45bf1e4fe85062e15a7690bcce1fc32d9d7c100ad5f0dcaa6e450a5be48930
SSDEEP 96:KwX+KUs4jmvzVJlgpBIzLLgKz1LdgfbL49DtGNaK+0SGo:oGTJ9v
TLSH
T1E4917201707F465138FE641CA2B6952ADE4231637A1CE4AF7BA950A24FABE115DFCCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593483.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593483.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 17a3f3196131dabdd293a7dc5d5c808e3bbc64c11cd09be006402b2af9675ac6
MD5 57630ce7563d1f28704fd7a0be031b3e
SHA1 4253646fed72be37081582bc6de88f7598f3a0d4
SHA512 0c2cf810e8e921b775af7b10e545d1d4d9024b063548b9cba8ea35ae4a31d4730ecd0bbbae2876f9f27aad33dcfd7412739e64f5c49e9eedec80c128a20f023b
SSDEEP 384:yiFiZcIUzsN38TUNTUlIlkYyA40g8MAp29uO8ZYOznTKwBODNZOCZWC:5FQoywgP4Spon4YOznewBKZOMWC
TLSH
T173D208F258DB5836D9AE6B43B73E2D034EBCC167F5846954B3986A0CCC961BFC30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c2d10644585bb7abc5b7166f579cd256e83cf844866c0114003d111b84c11006
MD5 7a8c7874f99a39cb0933ed0f5894033f
SHA1 fde1be5576d22ad5dcd707138f023f61c93df1b8
SHA512 5dcbf1efa36beebd528796675bf0e42e2e9943b0244a5ae436f315a336f33512d9e5ab19ebea678352a945737e2bfe25eb0163d5d118d1a16858f07f4acee2aa
SSDEEP 192:uWLsNtkgQvGz4lCWt8/0QmiU17Ep8BiSuOCzQOuGYhGXHKiqnTU8:rsNtkgyA40g8Mip29uO8ZY/zU8
TLSH
T16A32E9367838AC775EE6B641B4473A13AFB4512BDA883E94D6EC2F1C05DF29C230A517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6e323c34a7f019cc7ff9a91919376bfe9f05f66ddc2528733cfb2e965e9e9d71
MD5 d112a940a5b6fa02b5a93de0894cb7dc
SHA1 fb17a8766bcddca4c110aedd42fb92a30b2f39a6
SHA512 eda8140f9112658afddf906694721396461e5540706ac2cafd0ee506c96450f553d1db5910763703ef64b017f4fd4cba2d02cca15bf82706e002ee1a46f312b0
SSDEEP 192:YONC6LCWtDQmiUyfRILSuOCzQOupsEVnXU6:YONC6mg1UImuO8mNU6
TLSH
T15B02F9367C6C6C779EB36E45B5873B176FA8103BE9912F54DAE82F0C01D764C230692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dbc4048e12db4a4f312d462c8e9370957a0b04dd557155db98e62ec221225482
MD5 aa00398dc18dfc9bad1a5224326360a3
SHA1 092169fa4b0aa91b95614f55076cc7cd541d23dd
SHA512 5bf4236ecfb436dd4f0dc4f6ca62352610137668b91b8124f715574bb1c05f15218d884c0945885a74160bd5ec4f5237bd06d55130507dce113d8bcf04b906c5
SSDEEP 192:uWLsNtk5QvGz4lCWt8/0QmiU17Ep8BiSuOCzQOuGYhGXHKiqnTU8:rsNtk5yA40g8Mip29uO8ZY/zU8
TLSH
T14E32E93678386C775EE6B641B4473A13AFB4512BDA883E94D6EC2F1C05DF29C130A517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 14f750ef959715a164db4e5af77dbf1d79919ca67aa6762f6724338ee02d3991
MD5 950b01591945c802eb311725f71ea6e2
SHA1 3ce8958533aee962ebc1d77082e9a3444eb6a932
SHA512 6f52064c7de8cbdc197f90ae0ebb6f0cb37b4727882b6c4d9f74f39697b9ca2def4c3f332bbd50d47685bdc9d4c2e30481624f5d388dec249c046cb420feb7cd
SSDEEP 384:3ZcIhsNtkYyA40g8Mip29uO8ZY/znTKwBODNZOCZWC:/h84Epon4Y/znewBKZOMWC
TLSH
T11E928C726C3C6C769EE6B641F84736075EB89137E6C42EA496EC7F1C05DA288130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 023ca4af8ba7f3790f6e62f3e87c3fc01da287fa714bee9735ec065b842c669d
MD5 dc70497bdf1e372a166248f0794ba0bc
SHA1 25ca1dd7859d754e71a9a846b8feceb877948080
SHA512 2a622df0d0f324d7e0737c08350ad686585ae691c83b2bf74a3949b5ea0303bc922c22a72820c933690ebd89c5bb8425eee0bcd4ab4344a518e90dc7941c3aeb
SSDEEP 192:zONY6LCWtwQmiUyORoLSuOCzQOuGYhGXI/iqnTU6:zONY6mgw/omuO8ZYnzU6
TLSH
T1F712093778286C675EA2B981B4833A135F785127EA843F54D6DC3F1C05EF29C130A517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d65bf4c0-41a7-4aba-b941-d17e4de01527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d65bf4c0-41a7-4aba-b941-d17e4de01527.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e4b44f6eeaca943e1fa7b47a770de99be33489da47bdaf419e6db1738eb7588b
MD5 3255025eb2c82395c1275e62a70ddd2c
SHA1 1cd16fad17a9d97a20dc458eca82ab199d63ed5c
SHA512 6cb97fdfdd57448b513be9499d8ab08110f273710a53d4cd25219b278ec8ab58a95bf972fba8640bc742148f9acead4571c6961c3a57caa62f9bad731ee29e6e
TLSH
T1F241F758AAE91158B3B7AE5A9BF6686D483FB9372F07D05E10010E4F4A22A00CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download