hxxps://vpnstatus[.]site/vpn/trubavpn

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
898s
max time network
757s
platform
windows10-2004_x64
resource
win10v2004-20260911-uk
resource tags

arch:x64arch:x86image:win10v2004-20260911-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
07/11/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vpnstatus.site/vpn/trubavpn
Sample261107-v6mkpsew5j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{16FB7584-2ED8-48EC-85C4-C19E1C3B1E7C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 560	2052	msedge.exe	86
PID 2052 wrote to memory of 1084	2052	msedge.exe	87
PID 2052 wrote to memory of 2284	2052	msedge.exe	89
PID 2052 wrote to memory of 3272	2052	msedge.exe	88
PID 2052 wrote to memory of 2284	2052	msedge.exe	89
PID 2052 wrote to memory of 3272	2052	msedge.exe	88
PID 2052 wrote to memory of 3272	2052	msedge.exe	88
PID 2052 wrote to memory of 4532	2052	msedge.exe	90
PID 2052 wrote to memory of 4684	2052	msedge.exe	91
PID 2052 wrote to memory of 4532	2052	msedge.exe	90
PID 2052 wrote to memory of 4532	2052	msedge.exe	90
PID 2052 wrote to memory of 4684	2052	msedge.exe	91
PID 2052 wrote to memory of 4684	2052	msedge.exe	91
PID 2052 wrote to memory of 1632	2052	msedge.exe	93
PID 2052 wrote to memory of 3764	2052	msedge.exe	94
PID 2052 wrote to memory of 1632	2052	msedge.exe	93
PID 2052 wrote to memory of 1632	2052	msedge.exe	93
PID 2052 wrote to memory of 3764	2052	msedge.exe	94
PID 2052 wrote to memory of 3764	2052	msedge.exe	94
PID 2052 wrote to memory of 2956	2052	msedge.exe	97
PID 2052 wrote to memory of 3688	2052	msedge.exe	98
PID 2052 wrote to memory of 2956	2052	msedge.exe	97
PID 2052 wrote to memory of 3688	2052	msedge.exe	98
PID 2052 wrote to memory of 2320	2052	msedge.exe	100
PID 2052 wrote to memory of 4816	2052	msedge.exe	101
PID 2052 wrote to memory of 4816	2052	msedge.exe	101
PID 2052 wrote to memory of 4816	2052	msedge.exe	101
PID 2052 wrote to memory of 4152	2052	msedge.exe	106
PID 2052 wrote to memory of 4152	2052	msedge.exe	106
PID 2052 wrote to memory of 4152	2052	msedge.exe	106
PID 2052 wrote to memory of 692	2052	msedge.exe	111
PID 2052 wrote to memory of 5036	2052	msedge.exe	112
PID 2052 wrote to memory of 988	2052	msedge.exe	113
PID 2052 wrote to memory of 5000	2052	msedge.exe	115
PID 2052 wrote to memory of 5000	2052	msedge.exe	115
PID 2052 wrote to memory of 4516	2052	msedge.exe	116
PID 2052 wrote to memory of 4516	2052	msedge.exe	116
PID 2052 wrote to memory of 4184	2052	msedge.exe	117
PID 2052 wrote to memory of 1504	2052	msedge.exe	118
PID 2052 wrote to memory of 1504	2052	msedge.exe	118
PID 2052 wrote to memory of 332	2052	msedge.exe	119
PID 2052 wrote to memory of 332	2052	msedge.exe	119
PID 2052 wrote to memory of 1772	2052	msedge.exe	120
PID 2052 wrote to memory of 1772	2052	msedge.exe	120
PID 2052 wrote to memory of 3040	2052	msedge.exe	121
PID 2052 wrote to memory of 3040	2052	msedge.exe	121
PID 2052 wrote to memory of 116	2052	msedge.exe	122
PID 2052 wrote to memory of 116	2052	msedge.exe	122
PID 2052 wrote to memory of 4852	2052	msedge.exe	125
PID 2052 wrote to memory of 4852	2052	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vpnstatus.site/vpn/trubavpn
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa934bc188,0x7ffa934bc194,0x7ffa934bc1a0
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,6937147513714483269,3428468446301878777,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5350618580010889225,16339581331043767285,262144 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,10649492301191935354,5633583684146975468,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1299206606725141813,5488298181447859209,2097152 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,12851226729804733051,4059206834009485678,2097152 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,6305833559963197587,6723861075840609865,2097152 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,18312764864153834394,5995732606759303908,2097152 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,834569953297543421,15107396413146386365,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,11389713711908779633,16479123040337167621,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,3984734692437625270,17655589321279547758,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,3984734692437625270,17655589321279547758,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6312,i,13307016282947309463,10988307950928399589,2097152 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6400,i,11305427168945515515,8693009078648330419,2097152 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,16719131737531259166,88955391774729799,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,16941004465036049272,17173842586102066434,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12905985840422419313,7403615195733204688,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,6542279952827947712,95769710375137665,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,1393235022743365569,11187921179040447494,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5240,i,893169461947355779,8889127774111540369,262144 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=uk --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15485733751926846331,11619037833871375086,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,4773053323231057797,685275006380536864,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=uk --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,8968373769557147665,9490070745520842595,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,17369159219247791100,12457265669916670872,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=uk --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,10828885670075826759,4738638997905673822,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2736,i,9001335224104778533,3995889100323233669,524288 --field-trial-handle=2284,i,2639869048874895530,3054412034257440029,262144 --variations-seed-version --mojo-platform-channel-handle=1500 /prefetch:8
  2⤵
  PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4a1af087-2b45-42a1-a0b7-d8115a270957.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a1af087-2b45-42a1-a0b7-d8115a270957.tmp
Size 8KB
SHA256 805ea58c1fba1a04eca2e809c314be0000aba005cbdb3c011c5939c0dfe8ab5b
MD5 ed56ec1da8e5cebec77d0c4db2fbbc42
SHA1 ebdd008b313e533886c04bb1e5d2001cef8dc7f3
SHA512 0e3cb8dbeda77f147e19e521b736b1a97377e2476e31347baddff42629301c84961f895454380a21ce721f9583c66f8bd45572859d94d64396604e31807a0760
SSDEEP 96:3qONk3Qsjpfe/tyng7X5ih/cIPURHl8h4otop5yYDINBnP9ZvEI0IG2jbUEmmtIX:aONL6IE7QmiUy3ITPuIGmt1+TC7sw+U6
TLSH
T1E602F935AC787CAB9EF3AD09F4873A235FA5112BA6952F84D9E81A1D00DB24C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82f7f8c1-9827-40d4-ba43-6fe0336abbcb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\82f7f8c1-9827-40d4-ba43-6fe0336abbcb.tmp
Size 18KB
SHA256 58f5406165322b5e60f36d734c0ba07f586ffcccbaa4bf3391b4d7e55d16e621
MD5 d6c4d5e4770017b3d4ef364cadc2661f
SHA1 0c72dc5c1dfd4ea9db7c52b9e4cf63ce75b4e6eb
SHA512 edbd072a3768f08d41e71c749a7028d426db140c675c24679d5b1b126d6403733f7d0ba5a239b47e9ea5a4e4c01cff63a016602ca280d5882abd40a89c7a4719
SSDEEP 384:HvFwPasuvsNLWgb1JjHzIGmt1+ZQyniOekDnS95NYcX3I:HzCbPT+1WdniOekDm5NYkI
TLSH
T1B5827D768C74BC266E93A644F84B39139EB19267D7C96F94D5EC671C00CF2CC130BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91ecb2ab-f6b0-4367-87cd-365ae5a7fd13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91ecb2ab-f6b0-4367-87cd-365ae5a7fd13.tmp
Size 8KB
SHA256 6f9b91ece7c785877470b2cfaef742681b9148310f2a2a41cccc60264458718c
MD5 d6953977be9a1d71051d7df8c3c65377
SHA1 c685c50616fad277abd34e454f9f986caa11d0e1
SHA512 1840b09272e7197f8b47e3e98271c409cbb21a535386b065a47e60aa00bd289e08539a1fc57df13a1c61503aff31199b5ccc5822e27ef4ab1734c02e7d5921a2
SSDEEP 192:ZON26IEbQmiUyHIT1uIGmt1+ZQqe5qk127HEqIekU6:ZON26DNt1uIGmt1+ZQy5HOekU6
TLSH
T120121A319C78BC6B6EE3A844B4873D179EA55217D7897F90D5EC1A1C00DF25C134BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

2af33578-6c5c-4f01-9ac5-e6bbfdf81247.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2af33578-6c5c-4f01-9ac5-e6bbfdf81247.tmp
Size 10KB
SHA256 c042579612a22540e7fc5392e696f80e1ff78b933134a1f81330ab39f3c3d4c0
MD5 792ee34811c5e4f636ffd508e5480028
SHA1 ef87302b0a171122bb1486832f7611a86f1f6231
SHA512 1d8609dd4f3f1a6ebd00f347e332cdf57699cd95d3a984ec4d266f794c065573165d59b4755e616d4e913b85bfe84860ca6d4dcbf96b1883e8e090a7c2f73c11
SSDEEP 192:sxZuRZWQ/fHsZmKqqp4HHW6+WNHoHXYapV0SZIg5hNJ:sxZumQ/fHsZx6HbYXFL
TLSH
T18B22D8166E38A97B9CCBD209BB15BF13D6F9503291D51E48FAFC962C04E66CD234780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

464da8d2-1114-42cc-ad5e-2117a6376561.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\464da8d2-1114-42cc-ad5e-2117a6376561.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4f834e8f-1fb0-4573-836e-dce5fb721707.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f834e8f-1fb0-4573-836e-dce5fb721707.tmp
Size 27KB
SHA256 65b38137eb08e2559d187b93d3af0d595b697fe0fc06f6994e692778e0d60ab2
MD5 fb152157b6efc41a08bbfbfd8c72951d
SHA1 0840ab74463b1a6485bc87438f6d155080ce860c
SHA512 74b464f59466cd9374b940dda2cabdc121f2325458d545c46dc04f3f618a2c3ab9f14111f8d422d825cb8f2ef6b8805c3937e1e4281298d67013ae776d5ed1a9
SSDEEP 768:WwWPcLKWvKece8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7aro4wSSmRC:WwWPcLKWvKeceu1jaClLiF7R4wSSmRC
TLSH
T11EC2FA3F644CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63ad7ec5-7d2f-4ad5-a4eb-1e9be703cad3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63ad7ec5-7d2f-4ad5-a4eb-1e9be703cad3.tmp
Size 10KB
SHA256 f512facaf87d0cfabb22c44a5161fc8992fb5903eaab68121f3c3e49f5cda99f
MD5 8684cc666d8a200d65d31699e304fe17
SHA1 d83b927bb01f6aa66d32bf66d18bc8a080800817
SHA512 4fd585073d7754a2dce0e1e5aae170b09e6271e51b691691ae561fe66f768fd670ce0e959c1b29396a09d096edb573a374c0affbcb7e4625e0c12c264cd9abab
SSDEEP 192:sxZuRZWQ/fHsJmkIqp4HHW6+WNHgf/Yapd0SZIg/NJ:sxZumQ/fHsJ36Hbs/Ff
TLSH
T17822D8566E38A97B9CC7D20EBB15BF13D6F9503291D51E48E6FC962C04E66CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82566c42-9090-4a99-abc7-37689e5ae821.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82566c42-9090-4a99-abc7-37689e5ae821.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8665d2e0716083b9611f2bd5c359dae1e4732360fdfd6d60abc40180b7cc2d1a
MD5 4dc648111a41c68bf5c44d6074f15f43
SHA1 561b91047315a22cc88accdc95e2588c5cb9c90d
SHA512 b2740a71e581cec16a62111e53b48a1d94e1a05338debcf1c7259cbd96b0da73db5052a6b3564d2abbc5cc8204f7b3a9e9638072bbf34be23e67b42203823bb2
TLSH
T16AE0DF88A5C8C66EA618644B83AC630CC3C1361B93C0BB0A374DC48972024A5F2A76B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 57e4d058386c81d99bb54b6adf2c3352d7127ce3a630e019771ddd0e7a46dfdc
MD5 9fb781bea723f4c092242b9180732c7a
SHA1 badcfd8bd7bf9b57857f327469085bb78ee38166
SHA512 79878a0eb3e2fa129c04e804fe9b8ef478dada5f426cbde2c0fd0fa33f29b7f03c747229219627e2feeeaddde32edac403015fbc6a13b955a0851b6025d702b4
TLSH
T159E026D864CCC26EA20CA45783EC634CC6C1362AA3C0BA4E1B48C4887242080A3A77E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7f202ddad9edab7e575859c354b98622bb3f8e30f37f68aec25f0f54d9b6aa68
MD5 1c56153b3f168ec6fc779f4446c0d3c4
SHA1 a96ab323c24156709b6846ed0de7556ab84dec10
SHA512 1114e45d78fa0d23530604c6b5f15313fa88ace2df0a66e15ac188fe367c46905f981eebe6b502620a0cc5d8c04afca86a6d8edd111c008296957e3946ae5982
TLSH
T1CDE02689A5CCCE2EA308748743F8735C8AC1369FD3C0FA0E1748C8C87286450B68ABA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c6c5ed7810dbc1e00a93723836ed83322feafc0e6c42e0d6d234a3f67995e2a8
MD5 83aacc30fd9ab2456e0c2df000025dee
SHA1 51e8c1875bad547b6382ece1b58f86a8cf62d89a
SHA512 cac5dfea97520282496422b990231c614a4c2bd626e1654556ba8b16ee0a6259fba7408f8244dc75c40c5072a5202b9238dadb7560022b0126bbc8944f484e0b
TLSH
T1EBE0268994CDC22FB308A64742AE634CC2C13A1FD3C0FA1E2B4CC489B243040E2A76B4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 078a097f9706b5a4f8cfb9f7a834cc0d69d1bedd218ba621cfe6b2671502f63a
MD5 acc41ea2707a0e58521b9e4f5d4c72c8
SHA1 414dd5fd263c520593f9ee00a550e534eb3c45fb
SHA512 ca90b2b7732a8c6c2c3c99ef78dadaff2af7e17fa9e95168213e7aeec2e07087f689f29a5cf964f38067a6d63bf10a11f65059b57eba53b5f9cac34d14d4ce30
TLSH
T14A5173D64FFD14ABCB9A9335D3C4964F733297BC4AF36FA2A144C6B45B0AB849210817
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3c9b4225b89896815ab1acb74d7b29c2c03cc3323b4e9b9323b192fcb2445d92
MD5 61ca8bdf71bcbf8d032d93bb371a8d1a
SHA1 f2c549535dc6668d7d81d3713516ebad8fed7fcc
SHA512 94d66e9d67043ecb7c070086752803b3d5b201571f0c9f239acf5ac3e2a3cb89416ef64d6ba718da91d78471efa29674451510d63704029c2a328bcdb1bbcc1d
TLSH
T1A751B6D64FFD15ABCB8A9335D3C4964F733287BC4AF36FA2A144C6B15B4AB949210813
MD5 SHA1 SHA512 TLSH

Submit Download

4d93873a-ac0c-4dbf-bf60-6c0edbbc72ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4d93873a-ac0c-4dbf-bf60-6c0edbbc72ba.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

29eacb5a-5b3c-48e6-bd32-688d59c6dc62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\29eacb5a-5b3c-48e6-bd32-688d59c6dc62.tmp
Size 2KB
SHA256 1f313d5327991f6c7b06240b2a83fdcd3f30f0ca1caeabff1e918614045725f6
MD5 ac1c848c349db6568440b1d256d7512c
SHA1 16a66be51bc1ecf5902bba49dbcf3590a93e8c78
SHA512 1f49486ecd5a04f871cfd2f1917133760fbc87755f75328a230e8f94f5fa5243a9bda301b70ff991fe7c9dff32d66c0e4f3eef0889d99797363c8bd44dd0e0d8
TLSH
T141517CFB47F0877E9915A1F0EA086E1B8E990016432C7CB785D5BE62A3E3073D14175B
MD5 SHA1 SHA512 TLSH

Submit Download

2d9300f1-d4d7-4b4d-a9c1-eb8bfe80cb38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d9300f1-d4d7-4b4d-a9c1-eb8bfe80cb38.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

3f0807d3-f130-4e78-968b-e684d75f4715.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f0807d3-f130-4e78-968b-e684d75f4715.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

873fb7e9-99fa-4e78-a965-df8dfadf9f65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\873fb7e9-99fa-4e78-a965-df8dfadf9f65.tmp
Size 2KB
SHA256 23443bd73da47e199cc6152a81db9a2018119abf1d79d9b837725cc42909705d
MD5 9647d69e9feb2ac5059f01126fa0293c
SHA1 cb40164c8182fca7145ed82a8a54ba0db187a9c1
SHA512 50c86a407b2fb40eb70bef0d8440207111fc4e5ed9714ef7ee9c9bf012408b5cbad63e591e876990f353217325ea2908376664039b816a5ea5b58bd7cf55285e
TLSH
T1B95148F747F08B7E9905A1F0AB186E1B8E990426432C7C6785D5BF62A3E34B3E14164B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b7f8d10c-819c-40ac-9025-7abeb54304a2\index-dir\temp-index
Size 360B
SHA256 3eac0f772f11533075dee3085b97f5d94984dfc75014938ae20766e579bccd20
MD5 1acd60a2d77a629d40c4a37bc0611a95
SHA1 f475e2fba489c87262a2d6196c819df987aac3f0
SHA512 59369321d01c2073478ca80acd1b53032278632c03001c5d3c88ab1e905a005106ae086b9137a9d8f3ff124e25143c2c9b55691842062695206e2c3107653b6c
TLSH
T187E02B981D275186FC444072643EA072573518FC5314160F74FDA0578C0B784FE47718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b7f8d10c-819c-40ac-9025-7abeb54304a2\index-dir\the-real-index
Size 360B
SHA256 1676456eda1a138191eb66025ba5f68760f00fc6f7db0478406bd6d18cbb6eea
MD5 fb2854c16bb165bd2c5d307f0ef453cb
SHA1 52971a471b60985e6b5ba75fb660b8cac2ebecde
SHA512 adb50b8d188de4be70ea2d5640c68ac03eb4bac356b2f5b10b5112a732cd6c36694211dcae400f8531c866764df21467217e2752baa7c7aab5024988c11bcebf
TLSH
T199E0955D0713C145F8080032357F60326271281CE324270F71EF8055CC47B489E02F14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 800dc32233021bc7135e58d27b680beb135efcc921dd40523fa9c566d081ddb0
MD5 f83b748ed8be783e24f8ff83970a70a4
SHA1 46e4eb88685da1b5959453fb373f0299cadd0d0c
SHA512 e0386879970f44da7cedb2b716520b2ea76eaf44eed0eb745d71ce7d30403ad6dd0d94b5e5fa9db5c526a51b0728831fbaf7dc00ca556807d5ca6f345849828a
TLSH
T13BE0D8BB39E72820BDFBD7E624704057011976888549EC8E442D9AC710713B5649ACA5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0da8df426a327557ec3779160392d5c564772492e0837a8b6b219435a45b9ec8
MD5 b61d7890de0c674eb9e82849a8403f09
SHA1 9d1d8814539c233dec6401b4e5ee8cdf1cf63d95
SHA512 c68d6a19b68c92582b8ac86cb89770f2f025d64c01e5c5694f2920671d1d021960b9c1a5d4a701fb0b1f3063f479e58417d7bf18327adfcb7b4f6361ed9691b6
SSDEEP 24:KgeJGAEI5Kyhw1aSTUNyX8rUf4XI/KrhG1PSvYzH/G5865BxxdkllmQIb1dKyqh1:KonI5KEw0zyBAI/KtGNMgI7KlCczyS
TLSH
T194913D01796E02803ABE285E45B4866A564231B73219FA7F3FBC54A34E37E541CFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdd970cb-10c9-4231-9375-e10efe3a81ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cdd970cb-10c9-4231-9375-e10efe3a81ee.tmp
Size 25KB
SHA256 7a8bf60caaf14686dd12c36bcb96bd5f51d9cb1916be73734a0c5fcae2d8c203
MD5 ab87b90ebedb9d1057cc9f1d397ab1eb
SHA1 663b7547443a20d7c9c046cb1b1e996f02acf3f7
SHA512 2a4a48d52634ce664f0c8690b9b405b7e7ac18d51311c2603aaecc5f668902a1363ed1ab0539f9950d62ed8d066500b1dc7c66559d0662e648c9131dea2554aa
SSDEEP 384:sxZusQ/fHsv66s8qMpRiYnazAW8pZS15posJWeT+KxgHbENmZ:sWsQ/f+4Mnc7WeT+KiHbs0
TLSH
T129C2F6059924C83BAFC35D18653C7E33D9EC506222C5CEDA5AECCA2C019E1FDAB4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d83304fc-798f-4344-8a4e-6cf0b0998049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d83304fc-798f-4344-8a4e-6cf0b0998049.tmp
Size 10KB
SHA256 71692df712fa49cd23b7a5f924c8ec71b449937a4f345b05912e8acc1344a048
MD5 5e9da0c8f3907337df4a08b6dbb244c5
SHA1 c1ee2ba3cd50556832097dd3e0771a1bb5d25326
SHA512 4b48e73c3446f2bc9bd358e6f000747b87c05345349df4433caaa9649759f3748cdf3bb0a4b8c665feba4a2c6a486bd747ec313860083fa9c6d5deacdd319db1
SSDEEP 192:sxZuRTWQ/fHsmmKqqp4HHW6+WNHe2KJZYapqL0SZIg5DNJ:sxZusQ/fHsmx6Hb+PJZo5Z
TLSH
T15A32E8126E38A97B9CCBD209BB15BF13E6F9503291951E48F6FC962C04E77CD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fbcf79d-8cce-442a-8bd7-a5d25963a386.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8fbcf79d-8cce-442a-8bd7-a5d25963a386.tmp
Size 22KB
SHA256 6e58e69a07fdfb27891cfa9a663b1cd3f76e4a77ea6f312fab0beb3b92ffb513
MD5 0e9aef861dfc449f7c41490bc0935a6a
SHA1 415c9a9af8ed42ea8a4b1c1714d8ffb40ebd3d5d
SHA512 56b3c671441a5ee97333d065bef62a5294fccb6e759bb5436b832e1cddb040fbe14977a7faf64eeec68ce7a321ba6230984dbe5437efa8d5ac6ce8ba03b4515d
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uo:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAR
TLSH
T12AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d1d71d71-c8d4-4eed-9eb9-c510ee57d950.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d1d71d71-c8d4-4eed-9eb9-c510ee57d950.tmp
Size 18KB
SHA256 444e296ece278a3c764f336ae5df06664470d091e768004fea313b68eb5c90bd
MD5 755e543de54737df22646becfe59dba3
SHA1 777919d4fe9a1178de6ae9614f6cd1c7d14f7efb
SHA512 ba9734b13b9bff5347badf5b4a49fe407a6e925b6602c4a09c0d906ecc0a0c9b98661b0e2c985aca4714e72a41181f69d2d7f52587cadaba9a6b15e0b2ba419d
SSDEEP 384:DvFwPasuvsNLLgb1QjHzIGmt1+ZQyniOekDnS95NYcX3I:DzfbqT+1WdniOekDm5NYkI
TLSH
T14B827D768C78BC266ED3A644F84B39139EB19267D7C96F94D5EC671C00CF28C130BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69036512-727b-4552-b9e3-89a66bc1a159.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69036512-727b-4552-b9e3-89a66bc1a159.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f6b02c1c-269f-4a42-a0e6-66bd64af0f0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6b02c1c-269f-4a42-a0e6-66bd64af0f0f.tmp
Size 25KB
SHA256 fc6036da09fc802b45286a9637d0fb17ffee2da98510fb8fef42300f41d6aff2
MD5 098f7fb981b755927b75c2c59eb8cd50
SHA1 b34f4ba6119a8df8c464260a1566c6ce0c6153d7
SHA512 3ef8f7ef1407e84cf1d5daef86684cf6592cd14c4bcbea394ce395c7f8c3771abbcd5aaafad9876468e0e6473b3b8e5e265fa4aef613741189fa2ef5d40f584a
SSDEEP 384:SCFwvFwPasuiJsNV8TUNTUlIlLgb1Q2HzIGmt1+ZQyAZiOekDnS95NYcX3I:DFwsQwgybDT+1WdAZiOekDm5NYkI
TLSH
T15BC21AF248E7A836EA9E5B47A73E3D038D7CC167B5855A50B7D8550CCC8A1BFC306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 19bd0707bda45149ffdb497a8b240fd7d6450e2576b573553d0e8a743133161e
MD5 9b72f0d90de6ab4662b04b510a80c0d3
SHA1 b8f2d16cda75e1794e8716c4f639da01b69bbd83
SHA512 142567a91d0be79f3e0542b48c44da8b34d7f3e984e11b107ea4661ded467a52ab2a6b4c92e114c025810d588b5a9bf0f6111972eba8faaf7a2760f03f895fc6
TLSH
T1FD410659B6ED1148B3B76E16ABF6A87D847FB8372F0BD49D00110E4F0662A44C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download