hxxp://vimm[.]net | Triage™

Analysis

user interaction
yes
max time kernel
88s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://vimm.net
Sample260731-atbbpaaa43

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299314018623403"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{C3974A9E-BCE7-4F8D-99E5-82EDB182534D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5036	404	msedge.exe	85
PID 404 wrote to memory of 936	404	msedge.exe	86
PID 404 wrote to memory of 4176	404	msedge.exe	87
PID 404 wrote to memory of 4176	404	msedge.exe	87
PID 404 wrote to memory of 4176	404	msedge.exe	87
PID 404 wrote to memory of 1988	404	msedge.exe	88
PID 404 wrote to memory of 1988	404	msedge.exe	88
PID 404 wrote to memory of 1216	404	msedge.exe	90
PID 404 wrote to memory of 2192	404	msedge.exe	91
PID 404 wrote to memory of 1216	404	msedge.exe	90
PID 404 wrote to memory of 1216	404	msedge.exe	90
PID 404 wrote to memory of 2192	404	msedge.exe	91
PID 404 wrote to memory of 2192	404	msedge.exe	91
PID 404 wrote to memory of 3756	404	msedge.exe	92
PID 404 wrote to memory of 2492	404	msedge.exe	93
PID 404 wrote to memory of 3756	404	msedge.exe	92
PID 404 wrote to memory of 3756	404	msedge.exe	92
PID 404 wrote to memory of 2492	404	msedge.exe	93
PID 404 wrote to memory of 2492	404	msedge.exe	93
PID 404 wrote to memory of 3984	404	msedge.exe	100
PID 404 wrote to memory of 2360	404	msedge.exe	101
PID 404 wrote to memory of 3984	404	msedge.exe	100
PID 404 wrote to memory of 2360	404	msedge.exe	101
PID 404 wrote to memory of 3884	404	msedge.exe	103
PID 404 wrote to memory of 552	404	msedge.exe	104
PID 404 wrote to memory of 552	404	msedge.exe	104
PID 404 wrote to memory of 552	404	msedge.exe	104
PID 404 wrote to memory of 4484	404	msedge.exe	117
PID 404 wrote to memory of 3656	404	msedge.exe	118
PID 404 wrote to memory of 956	404	msedge.exe	119
PID 404 wrote to memory of 2432	404	msedge.exe	124
PID 404 wrote to memory of 2432	404	msedge.exe	124
PID 404 wrote to memory of 4828	404	msedge.exe	125
PID 404 wrote to memory of 4828	404	msedge.exe	125
PID 404 wrote to memory of 4828	404	msedge.exe	125
PID 404 wrote to memory of 5104	404	msedge.exe	126
PID 404 wrote to memory of 5104	404	msedge.exe	126
PID 404 wrote to memory of 5104	404	msedge.exe	126
PID 404 wrote to memory of 2368	404	msedge.exe	127
PID 404 wrote to memory of 2368	404	msedge.exe	127
PID 404 wrote to memory of 2368	404	msedge.exe	127
PID 404 wrote to memory of 456	404	msedge.exe	128
PID 404 wrote to memory of 456	404	msedge.exe	128
PID 404 wrote to memory of 456	404	msedge.exe	128
PID 404 wrote to memory of 2400	404	msedge.exe	129
PID 404 wrote to memory of 2400	404	msedge.exe	129
PID 404 wrote to memory of 2400	404	msedge.exe	129
PID 404 wrote to memory of 5112	404	msedge.exe	130
PID 404 wrote to memory of 5112	404	msedge.exe	130
PID 404 wrote to memory of 5112	404	msedge.exe	130
PID 404 wrote to memory of 5204	404	msedge.exe	131
PID 404 wrote to memory of 5204	404	msedge.exe	131
PID 404 wrote to memory of 5204	404	msedge.exe	131
PID 404 wrote to memory of 5288	404	msedge.exe	132
PID 404 wrote to memory of 5288	404	msedge.exe	132
PID 404 wrote to memory of 5288	404	msedge.exe	132
PID 404 wrote to memory of 5300	404	msedge.exe	133
PID 404 wrote to memory of 5300	404	msedge.exe	133
PID 404 wrote to memory of 5300	404	msedge.exe	133
PID 404 wrote to memory of 5492	404	msedge.exe	134
PID 404 wrote to memory of 5492	404	msedge.exe	134
PID 404 wrote to memory of 5492	404	msedge.exe	134
PID 404 wrote to memory of 5596	404	msedge.exe	135
PID 404 wrote to memory of 5596	404	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vimm.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fffe38cc188,0x7fffe38cc194,0x7fffe38cc1a0
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,1626524021120822120,7541893804688517886,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2075538390322118559,4455331239032939171,262144 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,12019973274279432193,2331567442655204911,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15557732922695518350,3128087290111820962,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7773324559207218627,8112967450180465122,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,5827247138369489488,2791129113732507030,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,12615355288014511899,8668663759351920350,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,17445264069732844451,364625527612110162,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,6562152375286856834,3358567553040785887,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12627848076777743868,1488674574898016932,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12627848076777743868,1488674574898016932,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6196,i,4051599776300802228,11990649867041253430,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,5830816526723605725,4788639230065474419,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,12771333037562434367,10200020372681850700,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,15076612254402094444,16973157075889522389,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,6683853512789566412,18137626106464800925,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5676,i,6252280097729120153,1765421821712073808,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6232,i,11424582244630663892,9956693215389979220,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6476,i,10716347438703559584,1383370747681801206,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6592,i,8156252418692289667,5875415424144806485,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6700,i,4232976601522421136,86928090659296576,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6332,i,8693017288092513727,8401902045096474729,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6380,i,658890203387139237,3077581305418423806,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6648,i,16724416908440925626,8527255515866235622,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7108,i,1484306327477499716,14135183794637359090,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5960,i,2860193150888144058,4306596189398368864,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7464,i,3808671829917992873,14421666058307617163,524288 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8180,i,7083806641883978815,16380679472019790479,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8064,i,15574084269669480852,16258572270509680775,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7968,i,6510234657112511557,1287882805413657948,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8324,i,6557936449906951839,4973888548466917313,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8368,i,17761920850959109085,11333269732485090360,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8508,i,3806054514051385864,429937426500526763,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6744,i,17780927324609559928,3595226826757424082,2097152 --field-trial-handle=2308,i,13885896178855573683,14051640894417704616,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d18b6ee50f3ce6b52b2eddedaee784089504a29ba2a8b879aee2a517f9eb52c
MD5 cf6ec8415fdc317cae2dc60f9a2ac98b
SHA1 3bce1333ca22dbedca28f11f65e16b470e4eaa4c
SHA512 e0c3648d52018b9fe6d62e320d076d7e821ce1b62ff38c5f07d3f31b886ac4d32278eae5c5824b1bdbdd3640f744789968a71329d4e2eac13e21342bd743d994
TLSH
T1AA713B340B126FADFBE12E72E9E147057432D32DEA73FC2C6060A6BD610B7276026257
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e8a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e8a6.TMP
Size 3KB
SHA256 94822d8286329b98b63f800499e2498ca0a0b3ca7a702d91e07f802585d60410
MD5 d9d98737972368d917b1bcebe2be87af
SHA1 78ba05efa4c0e11db066c81dcfbcaed0fbb47d65
SHA512 e0ca7a79cbeb62ce0573d635bf4e7422e88ae67e4745e948ed44fbe6b0d909d4063b67bb2f33cf3a54ee61b351df58322055e69a1ff59fe43ade559658727215
TLSH
T124611B340B526BADFBE11E72E8E147057432C36DDA73FC1C60649ABD65077276026157
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

090aae7a-fe2a-48fa-817b-1151e2ce2d51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\090aae7a-fe2a-48fa-817b-1151e2ce2d51.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8d525e8706091eac0a5189c29d33d4e1d88179239df4eabb6a2567edd11081e8
MD5 4aaa6842a097c653d2db997461b7bdd3
SHA1 872c29ba1264ffa2239cd7ea112ff41f87f2638b
SHA512 053fcd6b33838abf5d1deea3e65d1f80b33990378df8ddb891b464f0bd78e0a4350cc88a400fbec75485e50ccf5e1e469fd13ad377910061ba8bcbbd7768c2ae
SSDEEP 96:DIRO38UxzjovwZ5sTxb5i2cbPnO9B1bWbecqRbljbh8KKbUA:DPsC3ovo5sFb5i2cbPO71bWbecqRblX4
TLSH
T174A19EF7C7E4857EC91292F4EB142E17CE58091A936C3D6AC5D8BF1B93E24B0E24095E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2eb6f2db06d2ea572cbc411b563326f86591ac41724c766c4e6c805159199c66
MD5 5ead957e3438fe52b8ef0272b976b15e
SHA1 a6be76e1c31853a6923bf9c7f2b5c90904e895ef
SHA512 96b5bff08c170fa0f399b393b56d8f09674f674a508db0002877d841d402fca7e11e43e65f001e82af3175904d8f210bc1dd3aca6ed53da52b569c49c99bf47c
SSDEEP 192:sxZYR+yM/jK1Ml8Mkf/f8sPssYIdp5CHW6+WNObmnZ/YLCWnUxIgrJ:sxZYsMf/f8s0sp0Hbu2Z/nv9
TLSH
T10D52E8166A345977CCDBD20AB945BF53E6F94472E2940E449AFC8A0C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 58256c540e75e92b89ec8074aed7c93f6eb34518767ed44ee94a231dc4645df1
MD5 73e4905d54995e47a8d7f5bc805d01ab
SHA1 7eccf9edfcc01d178b370e3e14fe1ef9ad92d0c7
SHA512 cc6ecbfc6de60ef628fbdae45d8c810df8bb784998fa130272777dfc381704b6634a99581e56fc504bd5377ced895b6ba0d4263c25d231580b7fd19ad6191157
SSDEEP 192:sxZYR+yM/jK1Ml8M9f/f8sSsxEIdpXtHW6+WNOt9ZYL/u61xIg5dJ:sxZYs1f/f8sVxd9Hb8ZSD9
TLSH
T10252E8166A345977CCDBD209B945BF53E6F94472E2900E489AFCCA0C14E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b0f48bf544928c85033d9588df1f40b82ee2f117685058f718b10a2e03e73d2b
MD5 77ff346da5c8970f2bfab1931645008e
SHA1 29c6a67cde7467fba8892a42e101c28eec6ef7c8
SHA512 508ed2e3f7af998b690b7e9b4267c2863be10e42e6b601e82920b8622572a4b4b98211b1a29bfdcab86268367836438a13e564e6fbe4dd295c5a38c5d94f5d96
SSDEEP 768:AGs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNCroAV:AGs6pD1WvxzWju1jahILIsNZAV
TLSH
T171D2FA3B680CCB7E4F844E5CEC2A6F967DD801CBAB98895447FA444C03C77EA512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 960735cd06d4ae49d7ab85aaaca427b45c1a04a7dd46138b3859a300a642a2a9
MD5 fc79b4849b5d63d1e83bbaa9b282c4c3
SHA1 97e750448a7869a848e1915e6f2792db4b4fcf60
SHA512 c8c7086a8576f0dd2e75ea45e2f1bd179f5a928234ceab911bd9a9bba8db60bea36f53777edf7c4120b7a822c7720395779c2302ede03190ba9208a07f7b2a05
TLSH
T1D4A0026612843007C4500278ABC157442329D8500323161580D855549F58697555A200
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f3b9fd73710c3139168402dbd6d9ae11166cbb957fb4ce94ca41b334584e9a7b
MD5 c1b758fa93b537cd3fe02a2f9d975f0b
SHA1 0d4e6a88e11b36cddbeccc2a9879c21a5b571cd9
SHA512 c4f47b698158c13c9bc5f90fdc69e749a50d1938bcf22604f4d10dcf6d342f17f9ac1e979c55e5e10fec3a72ee1d6c8f0efaea180b245fd973cfd0228984f536
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyhoIrKVicPdIxK2cUjy4nIZKYIsD:KUAAKtePiogKVi2dqK2c6bneKYIE
TLSH
T16BB10617327A02423D3E3A4883D58BA78E8271533119A42B7BAC0471DE6AE21DDFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 df1b4035217cbae0ad95d782ce8be1fe9f1e2a6ef7d4fe4462c8d5077897e22d
MD5 ce17fd8de25055b91bcafd97fa91f705
SHA1 8c63030285287c480e6acb81b7b32394f2215f4a
SHA512 eaf6e8302aa9d281ce67eefa77cdcb8bac2566f59ec72e4344699fc99744a6f27f8370f1305661958c7ca4be740134319df9f24a399da66c6a3627c86c33ae3f
SSDEEP 384:yZcIhsN5tf9nzGitzQa91O+MzozJrq9/OObjI9G6w7ad:AhUFzGWZHOZMhq9/29M4
TLSH
T16E927D356C384C7759B3D512F5873A279EF4503BD6D92E84D1DD9F0D01AB56C130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 23102e8455f14c1f024724693d5d61ec31eb5f8f8c4c2404d8e1f8adb3f5333e
MD5 91c024e0d45ad1b6fc0e48943018587a
SHA1 fe48328c08931233bf4704aa34ad44f298fba72a
SHA512 e803c5eae81f1bbb5f8ab7202ebd49ed1c7dcc0325a0e1a31caf1c77bd792e82740f3b2e69b4f3ac63280a9818f23ec7b83edc0d0576804e52d06103390138f5
SSDEEP 384:7ZcIhsN54f9nzGitzQa91O+MzozJrq9/OObjI9G6w7ad:jhjFzGWZHOZMhq9/29M4
TLSH
T1B7927D3668384C7759B3E512F5873A279EF4903BD6D92E84E1EC9F0D01AB56C130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05465755f6017967653aaa38debef038587a8bcf9ebafd3b164f62b5cc769d80
MD5 7c4860fd109f25e3a19282a69f298850
SHA1 1af1478194f3f30ecf263485b66def60e5c10288
SHA512 19867379d960c7263a9e6da93d2f5e485f963c79578b90447f192848b5545bc1bb3e84dc3e6da3e174b2e10282773d1abedde2d2427682670747907586941521
SSDEEP 192:qONQ6O7+3hQmiUy4kGttb0IO25h2sgG9Sv1U6:qONQ61MGt91O+MC9o1U6
TLSH
T18B02D83568286CB74EF2AE46B98737275FA5112BE9952F84D6E81F0C00DB65C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3f7437e0b521b135af7fdd27c8c7907c2321662cb5f0cf971797637c373ffef4
MD5 6fc4a3d2e55ba9761b853adc602e69d4
SHA1 7e78d97e448c0fc00477e3e868afa34101c9bac6
SHA512 4dfafd35b9bbfc00b119193e0ae0b5c78a653f463ee867b402dc7b80cb0e4af1d26700faae3e07723ca3ee032ae9f012fdc71351f5d7cb6af2e2bd217ae3e045
SSDEEP 384:mqZcI0zsN54f9nzGitzQa91O+MzozJrt9/OObjI9G6w7ad:RIjFzGWZHOZMht9/29M4
TLSH
T13D927D36B8385C7759B3E502F58736279EF4503BD6D92E84E1DC9F0D01AB56C1306C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f9ef7b5a10f8773f5a10b7581bc1b22c360fcc5cb1b29313d0f03e4a20285bbd
MD5 370ac5a4ac674b34fe5328e606161d14
SHA1 1e6180f0d495167de3fb28f7adb0da0bda46bc38
SHA512 8a87f4966b1a8cda4e73e716dd62285fb598b15e3f8441131faa8fce41bad5277907ad514eada76d804d5d3f98cb4e21d9c13f5d824bf7578322e307db23073f
SSDEEP 192:yVON86O7+3d6QmiUyskyZttb0IO25h2zMZF0SJrAcN9Zqa1U6:gON86yKQt91O+MzozJrB9/U6
TLSH
T1D2120936B8689C771DF3A545F98736179EB54127EA8A3F80D5DC1E0C01EF66C234AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7de5c5419691ecbbf74f75ec766c35c08d51b6c3bb0b4282f7f9845e98040f02
MD5 ff43fc7fe45118a52de557bde3dd384e
SHA1 983252ed43e4a41fa864362e37308218e7805334
SHA512 36a55411f65f7a662da484ccb7e51ad2aa327e5424efdf95a552691ccd9525929d4ef453ffc1170b2c674ac9023f4983fe8b1fd4fc89dc505c2fa04ff27fff12
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e7a1d2bc0f3842af9a22ebe756bd38337c88c39bcf2bb44a434c16732e7accb1
MD5 19df0e0340afc554bb83ab311da14a82
SHA1 73c8ba173f3c3d7e20675da874622684aa170bd6
SHA512 9c459117d2dfb5d92e13cb69605e442d7d04e744a662b68eb62fd59a0b4ffeb53dcb90aa0eb51e8b008d84a59d03ad2506e43de90e53a10ee084fcc900b9127c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5983ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5983ec.TMP
Size 392B
SHA256 ff7aa160c0dab86ba5d69d2ad32388f6df9e9449cdee6f4ab6ac29111990e1e5
MD5 6fa1a79674d0603142cd00a112bfdede
SHA1 3082ae412fa3a8d8efecfdb1b3bc527d72f1a9c9
SHA512 e8c99dcb75d1781149a365aa8f493b4d2980999f51f978ec08c0d35332f6c3691af6319b01ecd8d2f8017f2d37981e65d0053621de3f5c5b6204d67198891287
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9098aed3369ad4509325826ebda13206990c4b5a9c5f2e278a992c2bfda39027
MD5 d39747f05dbab905a6a003bdbc8f3a4f
SHA1 47df841040ff4c5a6ee2fac6b4579685b4978a2c
SHA512 330f02b76cb0ecd484159c1bb09a7cb144ddc364a64cfc661c24fb0e6377ce5bf30bf11509935f89de1064e21b8b32fb1ef317e8c0aa0887b4f48a3ae01e40f9
TLSH
T18B411C58B6E91108B3B76F169BF6B9AE087BB9772E4AD59D10110E4E0623E01DC71B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads