hxxps://vimbil[.]com/2EC6I8

Analysis

user interaction
yes
max time kernel
10s
max time network
9s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vimbil.com/2EC6I8
Sample260716-e9g7dsds7r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2044	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286503061974380"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{BCB850BE-E054-4E22-A0FF-F006C976394A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe
604	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 4444	604	msedge.exe	80
PID 604 wrote to memory of 2044	604	msedge.exe	81
PID 604 wrote to memory of 3008	604	msedge.exe	82
PID 604 wrote to memory of 3008	604	msedge.exe	82
PID 604 wrote to memory of 3008	604	msedge.exe	82
PID 604 wrote to memory of 1172	604	msedge.exe	83
PID 604 wrote to memory of 1172	604	msedge.exe	83
PID 604 wrote to memory of 2096	604	msedge.exe	84
PID 604 wrote to memory of 2096	604	msedge.exe	84
PID 604 wrote to memory of 2096	604	msedge.exe	84
PID 604 wrote to memory of 3800	604	msedge.exe	85
PID 604 wrote to memory of 3800	604	msedge.exe	85
PID 604 wrote to memory of 3800	604	msedge.exe	85
PID 604 wrote to memory of 2168	604	msedge.exe	87
PID 604 wrote to memory of 2168	604	msedge.exe	87
PID 604 wrote to memory of 2168	604	msedge.exe	87
PID 604 wrote to memory of 3316	604	msedge.exe	88
PID 604 wrote to memory of 1772	604	msedge.exe	89
PID 604 wrote to memory of 1292	604	msedge.exe	90
PID 604 wrote to memory of 3316	604	msedge.exe	88
PID 604 wrote to memory of 3316	604	msedge.exe	88
PID 604 wrote to memory of 1772	604	msedge.exe	89
PID 604 wrote to memory of 1772	604	msedge.exe	89
PID 604 wrote to memory of 1292	604	msedge.exe	90
PID 604 wrote to memory of 1292	604	msedge.exe	90
PID 604 wrote to memory of 1584	604	msedge.exe	92
PID 604 wrote to memory of 1584	604	msedge.exe	92
PID 604 wrote to memory of 1584	604	msedge.exe	92
PID 604 wrote to memory of 1596	604	msedge.exe	94
PID 604 wrote to memory of 1596	604	msedge.exe	94
PID 604 wrote to memory of 4044	604	msedge.exe	95
PID 604 wrote to memory of 4044	604	msedge.exe	95
PID 604 wrote to memory of 4020	604	msedge.exe	96
PID 604 wrote to memory of 2452	604	msedge.exe	98
PID 4020 wrote to memory of 1260	4020	msedge.exe	99

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vimbil.com/2EC6I8
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffeaa19c188,0x7ffeaa19c194,0x7ffeaa19c1a0
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,9723244060151432521,9687879371845686988,524288 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5107611279462924966,4534230259264395512,262144 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,7432411338093471151,2281505536600698910,524288 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16740607782108426423,8686679598458590777,2097152 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6040615323776495055,3278123764503786880,2097152 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,4199910068107292600,17535900385214686146,2097152 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,68379436899312727,7765647656179612097,2097152 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,13790461717297972131,945009941776852043,2097152 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4240,i,12492757813758157609,17041977228749761800,2097152 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:9
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3656,i,2763598337704655362,425866337132418277,2097152 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,7356868336319047640,7727997611459535992,524288 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,737410082768269865,12535694611162514251,524288 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,15708539980124537,6089374332550273624,524288 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,11229854537394693088,161332033180618340,524288 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,11229854537394693088,161332033180618340,524288 --field-trial-handle=2296,i,8297401992576867582,1080051175616260395,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 17f6454e00f11f35a3962c77376beabfa5b9b807d213279513322d19f8d1478d
MD5 46efbb67c5eda3543ccc8944c74bc683
SHA1 f2b2c60e6adbfcff84c8597627c9ac45b2d5eb19
SHA512 4a2cb4b9bd815fcc92c0d379478ffb4c0313026abfa60e08728b7cd8020f775e6f545da90d56c032dd76b76824e447b116c94e193267e2288470fc72b88dd0ae
TLSH
T1C1D023717A2D64D2D52D203590318300F5276B53326795467111D41E5D75CC5D78A6D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cdcdd06b9eb70763abb4bb13b194860c6cd4b52b58b59d5cb47058b2897b497f
MD5 6967d4d9bcf780e175b62ecdb902197c
SHA1 69607483c23c4a58e5fc49a169455521348616b5
SHA512 73ebc927baaf3b44d6aaf5b6df8326516ded5d8fdbfb47bc7caf08ab35ab0198e895b34d0befa6030d86f3a5f81f7ec632f909639e3cf9b998a43c79f2dae1f0
TLSH
T1A371F8280AB384A3E3A0D23185D1423D74B0F97737839F92128398B69F2FF67E557069
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588cca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588cca.TMP
Size 3KB
SHA256 e5a6bf8bb7ce9850bc9fc0a3f680ba5f4549c543a09097207e8faa1563a9ed26
MD5 e6c24476504dde10bed34e883c4ef456
SHA1 ba42ec365de96a1d2e874d6d7aa99feeeea12f35
SHA512 9f07745f7b14c261eb0e454dbd0c5a1472019a0efb24a0880ce7335dcaaa0868146ed7f232a91471d54673af3b08bfd40192899df04ef36125452817d90b4ddf
TLSH
T198711A280AB384A3E3A0D23186D1423D30B0F97737839F92018398B69F2FF67E457069
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5c7f6bb085ed65429f4b3a5d94c10686fb939932c7f2809885d889b1b36054af
MD5 c6e075f953b4cb8d5e7f1bfc7874b511
SHA1 1ee13d3f6fdfeacd5f0bbf5c1a897617f7ab4cbd
SHA512 c0875a6a2f2222441c7a4c12698ce575676b17ffeea7aa56225569207a86a4fe406a749ac0305dc751a4a914eee78b6cf7805c214c3c421463700d85a6075bfc
TLSH
T1404189B7C3E4825DD91226F09E18BE1ACE1D0918432C3D1AC9E9FF4BA7E2871D21255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 83cbb029269a4fe8e9a1bda3ff5de609fdbad2bad3f222749619dded7caa919e
MD5 0988b62a57c008393d2d986f37d9e0bd
SHA1 5c79d9f3199ad9a73a684739fe28fbbf2dbe2db7
SHA512 33f3f6e2218af1241b8a78cecbebd49696de5e8ed3bcadf645b7f9904fa3dfa45bc1d2b5d741cfbb75dc831d126f84969a91800fa4929925751f234105122073
SSDEEP 192:sxZIRpyM/jK1Ml8pFf/fZsSWpVytDrIdptt/W6+WNrhKZ/Y05C7RFIgFJ:sxZIPyf/fZsSWvytD0f/b6/52v
TLSH
T1B552C716AA345A77CCDBD209FA55BF53D6F91562D2900E44AAFC8A1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 df646ecc47b318b1831911afaaa2ef44f5f69d303db79fca3e333272311de3b6
MD5 7097d86d26b72e60dcd4843a5fd32d73
SHA1 63118065d056c09d4d65986455975695aad7c6ac
SHA512 33f435f3b1aee2ab78c4adfb6ab7448dca1f578fdf87103b48939804eebd8c9493ae097672267619e7e9efa920516d8012a26f58515b5164503f39415a45badb
SSDEEP 768:nc4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4X:nDu+68si2y1WRmlzQqju1jaKDILpZ8UG
TLSH
T18CE22A3B280CCB7E4F844E5CEC26AF966ED802CB96A84D5447FE494C03C76EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2b1286c86e218d5716fdfd92edde6a47d88b2ee7aebb013ae644b05225ab87c6
MD5 7f810a53f4f1403676d8035ad277e7cc
SHA1 eb2304783821304228bade5a7a3af469b79ce491
SHA512 65cfb789b6ce2e49757bec429ab58abc8809beec42786599ddf23c49843f5aeae50b12644cc715afb4c9226333bf54d0b361071c5320eb59f32392042a8d3b59
SSDEEP 48:K5uzH7Fr/vaHYmIzDvKY+AJv89/dQ3vky1JIRKCEELyBqIvKfqgGKhG6AU4kz:KcmAK/6a2JCKCEKSq0Kfq0z
TLSH
T11391779232BA5651BC3D3909F2658F264E42B2A73418E42B37A944B50F7FE142DFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 04c62b8be2c078a58e631a03e5519cfa4ae93497faf21bea1cd9b09c42e07da5
MD5 ae9dfe1b03d54f4ad70b66e085049b45
SHA1 65b8b16b32f7a2c6af2611954c9f8930dea05164
SHA512 d343268463a92dca44bc76c58179834c465bd0e930de3873ad103c61f01693730e523089bb16a0ed4d35a7bfe91bcda38b7429651d19cce045c0eed887c65e11
SSDEEP 768:aj+9UnvkrpjODVhiQfrk1K7k3q48trR+29MB:Z9Unmcg1K7k3DyrR+2+B
TLSH
T135C26A3D9C658E3F44AEBB08BA4E3A378EA8117BD5B45D88E7D85B0CC1B295CF706411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d0afa344aa8beec7a4f1f092cd322b58b7a6c0a943faec04de27eaab21234db
MD5 f9ccc71d2f0ccb33db585035accdd859
SHA1 0b026b6343e22c417b79c9f7d3742f5dec71b285
SHA512 1dd1c4b15d1fca586dcad06c675f62d912df13507b54576c500ef1466da497b6bc9b5e6fe52c3f81262b5bde6e6a43267748321cb596e169bd6d65b7fdf7e4ea
SSDEEP 192:nRGNe6yMQmiUy4JmG1Y3b+jcjOBfRJMnYjU6:RGNe6xrp1Y3b+AjOBaGU6
TLSH
T1D202E835A8786C779FF2AE45B98737139FE4117BE5956F84D6E82F0C00C725C230A866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 edada1105cf11803ba19b68370203d2228749d09e7147804211a147379a3770a
MD5 d20686877dcc1e5289663587004599f6
SHA1 b669ebabd4d169e37261565206d2492eaed1f1f4
SHA512 86dcc3c853ef18f6e62b206d664d8380bbcc83e3ddefef46a4e9779b90aaf5407779f41ab3a2ee0be636153b3576550931a012543b870455e6c2374bc272c975
SSDEEP 192:AGNK6yMQmiUyc0GwY3b+jcjOBfR7pISJrZ4MTqxnU6:AGNK6F1wY3b+AjOBNp/JrHKU6
TLSH
T131121A3269A89C775EA2A945F88731038FE8426BE689BFC0D6DC3F0C05DF55C130E856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads