hxxps://claim[.]ytrixy88535[.]workers[.]dev

Analysis

user interaction
yes
max time kernel
136s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://claim.ytrixy88535.workers.dev
Sample260819-vc24asycle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4516	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316319012843724"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{77BC76F1-7612-4D49-85E0-7BC3178B78FF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4480	4012	msedge.exe	84
PID 4012 wrote to memory of 4516	4012	msedge.exe	86
PID 4012 wrote to memory of 544	4012	msedge.exe	87
PID 4012 wrote to memory of 544	4012	msedge.exe	87
PID 4012 wrote to memory of 544	4012	msedge.exe	87
PID 4012 wrote to memory of 4556	4012	msedge.exe	88
PID 4012 wrote to memory of 4556	4012	msedge.exe	88
PID 4012 wrote to memory of 4404	4012	msedge.exe	89
PID 4012 wrote to memory of 4404	4012	msedge.exe	89
PID 4012 wrote to memory of 4404	4012	msedge.exe	89
PID 4012 wrote to memory of 4340	4012	msedge.exe	90
PID 4012 wrote to memory of 4340	4012	msedge.exe	90
PID 4012 wrote to memory of 4340	4012	msedge.exe	90
PID 4012 wrote to memory of 1916	4012	msedge.exe	91
PID 4012 wrote to memory of 432	4012	msedge.exe	92
PID 4012 wrote to memory of 1916	4012	msedge.exe	91
PID 4012 wrote to memory of 1916	4012	msedge.exe	91
PID 4012 wrote to memory of 432	4012	msedge.exe	92
PID 4012 wrote to memory of 432	4012	msedge.exe	92
PID 4012 wrote to memory of 2056	4012	msedge.exe	96
PID 4012 wrote to memory of 2432	4012	msedge.exe	97
PID 4012 wrote to memory of 2056	4012	msedge.exe	96
PID 4012 wrote to memory of 2432	4012	msedge.exe	97
PID 4012 wrote to memory of 4260	4012	msedge.exe	99
PID 4012 wrote to memory of 3564	4012	msedge.exe	109
PID 4012 wrote to memory of 4028	4012	msedge.exe	110
PID 4012 wrote to memory of 1892	4012	msedge.exe	111
PID 4012 wrote to memory of 4060	4012	msedge.exe	120
PID 4012 wrote to memory of 4060	4012	msedge.exe	120
PID 4012 wrote to memory of 2512	4012	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://claim.ytrixy88535.workers.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc4c01c188,0x7ffc4c01c194,0x7ffc4c01c1a0
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,635785675269273258,1769303127903596979,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,12807627353967914387,12240456699754016907,262144 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,4568011674300764882,3589478607214467167,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5210355888309330332,13475840433956085762,2097152 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,7299830071615537216,4397336230653724862,2097152 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4227743246726267876,10634103477624796523,2097152 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9255881113072392529,5755413005058988799,2097152 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,12285762096802135969,11248823301209727024,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,9404638085808010268,9482741996962202683,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,8840585121479264376,201329133844143011,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,8840585121479264376,201329133844143011,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,9400665085556868806,4731431128682841308,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,205603690665052562,8014294462684703981,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10740190960050570044,263725137818804854,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,668438015246740492,8207623686167104859,524288 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,1251257109888662810,16663052183822805769,262144 --field-trial-handle=2204,i,5225579996273236582,11159984033336198408,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5c0f2d4c8214f0ad942563c2c8d2943ac0024fd29ca4d158fab827b3d0510a9c
MD5 71a61656ad1ffca38e0e37bfcd445a16
SHA1 c7d089d219b4dd388ce96a472baab895e8f47bcb
SHA512 da2c31ad955c6cc17f4be9d8a8f361735a8263a5f186decc443c3504e2821391bc48eb9cdf8a5ca3ce2227e6dd2ce0bad80e64aef4bb770b230a775cff1fb58d
TLSH
T19861F739062E0471E39A1CF142D5220730B6BDEBF9561E74D6E09E37251FF25B93D908
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c06d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c06d.TMP
Size 3KB
SHA256 8569ac7783723689728ad81e087bc2c88997beae5d3273522c818ad53fce93e6
MD5 678f2bfe9dd536ae9983baf3006025ab
SHA1 a9b4ac7c9a49e2e7c11602c8057ccea7b160f819
SHA512 0f7219aad42bbcdd88ea94b5ca178689b26dfe59d9f8116f78167e925d82dbbdabf20c86dd05e8e9d567c4aebeb0caf36f987a9cc9d8e5befec5a0a95c663933
TLSH
T14561D5380A2E0871E39A28F156D5220720B6ADEBFA561E75C2E09E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a50cc3c9b0e0cfd4b01408828b11be8e310bb7c84749712e6038740ce615c3f2
MD5 700c0cdbb6c079da2ce37d09ae201416
SHA1 1f3fb8e6e55bf0c96f71de2f48e9a861426014b2
SHA512 2dbb40a36a753d3a5e719dc0cf989df1efbbeda7d97df45d0756fd81ed45b3ecbdb09614df58e768d1775d1b1b18ee170c0e640d62846cebc98480d8e02df72f
TLSH
T1E251EEB3C3D0852DC9155AF0AA986E27CE6D0614922CB95A9DD4BF0FA3E3263D10631F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5c310352ef6d13566cc234bcd0afeb32ebda7b608c0c07ebecb80cef5535683e
MD5 1b059e726ff6ceb6fed0dff7757879d5
SHA1 595a144a6ec1a2e8dd9eb636ce57732590d95737
SHA512 669e965f1ac8ecf37db240180d2f040b96067cce30d253657e495811a92443d2bb4b758052bbb60d76797547894839c4bc9ed44b5e8b70b28ddf7150f365ce57
SSDEEP 192:sxZ6RpyM/jK1Ml8MkT/fTsbWUZIdpJalHW6+WNwppr/Y9Ikl4KdIgrJ:sxZ6zMT/fTsbWzQHb8/IB9
TLSH
T1D842E8116A349977CCDBE209FA55BB53D6F5047292941E84AEFCCA1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 165eff886ec207e3eb5d3e1171b23ddccfa1125672a9c8c05b0152559864f888
MD5 5cbce2af0537ba534d584d4c449ef84d
SHA1 ed79b683385498ba843c4d88a4949f41b1b399ff
SHA512 543e059e484ebb8160f0cbe0c6b28f258b556ee006b5adb6b63f2a84cf0c063c0b3887eac12093e0368f52be02ee9242e2c8a0a1253a8abc427f7d543eb2cebc
SSDEEP 192:sxZ6RpyM/jK1Ml8UQxkT/fTso5zZIdp7WHW6+WNwUJXY9Iuy4KdIg5wJ:sxZ6zqCT/fTso5+iHblXVBS
TLSH
T1BF52C7116A349977CCDBE209B955BF53D6F5047292941E84AAFCCA0C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 13238f2d2c1beeb491f21df515a0a621bb55a802c40f4ceccd16def29c29c119
MD5 821fd0ad30f6e2128ed2c85d871b30e6
SHA1 43ec0f33a96916850385849b661444bcbd6b8606
SHA512 80e6e29fff8ae45b6025e295e7b8db1231d20fa66de4c261763894ecdad654715c0aaace31cfeefd9d6dcecb89abbe06eba8428e2a477c11f9214a63d707fd8e
SSDEEP 768:4pcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNHroFg6C:4pcv21wWvu+Z+u1jaeFLeRNUFy
TLSH
T17ED20A2B280CCB7E4F845E9CED2A6F8A6DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f8e99a2dbc682aac3ff130f2279191ed33fa34d1a49dca731aaa32ed86b44a25
MD5 0489a761f984f94e6a25f296a1c400a7
SHA1 055f45544dc93bb2c4f640135ce2731f81974642
SHA512 f453a7865dbaed52c70bc29889ca7a7d10910663c5cfc2239c0c0cea4b6ba9f7cce257b86b3fb6b8bf169118b4bf28f918dbc5416084dbe7d18a88ee3020f398
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqAoKRef6KcKDyCh:mTLqHPh
TLSH
T17C917716313B129278BF6848A3668A368E4636A3380CF56F7BB800750F27E551DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5948c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5948c7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 62eea02737583409b74f9fe7dbab191c7c819d7c8cacd466e12cd4851cfc573d
MD5 ca1c3c448bb9aa257effdf167eb4e016
SHA1 dc677a81209c0c7b34dc64178713dde79586b705
SHA512 1e54d2ccb8f99a72cfd75a4dffb135cfce787e9647ba8bf2b08fd581cb2c9b162a0fe1fe6dac6c05729115b4a205cbab967b85c1a51cc6c7699558a1780c85aa
SSDEEP 192:ubKm+xasuheOwQxMGsNAmQKvD2+YLe9oQmiU1Ejf4e+CGlOdmcheaOJilqTt4/t6:mpZcIhsNAm4ziesQe+CMOfn+iv+3Qe
TLSH
T16A827C306C786C776AA6E584F94625279FF89037E2C93FC494DCAF2C01DB69C131A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9cbdfb07e4d96c0e4c21036c9599cd78822da90ad56777020a745835847f0fb4
MD5 a134ff10eecb52f2a087bb7763999eae
SHA1 a0954e5a00419bd112a7ebef6a2b3e8a2e2ab179
SHA512 b97ba1021a7cf015f61cbc6224ef8f3cfb17492c552337423a3df028db072da4af7a4708f51eaae589eb0a589b4bd3a59651ba9bb5857ef0499ec9fb39543e69
SSDEEP 192:utKm+xasuheOwQxMGsNArQKvD2+YLe9oQmiU1Ejf4e+CGlOdmcheaOJilqTt4/t6:8pZcIhsNAr4ziesQe+CMOfn+iv+3Qe
TLSH
T102828C316C786C775AA6E584F94626278FF89037E2C93FC094DCAF2D01DB69C1316D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 664ccad5de6ab388d107114c7b05449b1ee9d96e9bcea2f9f11d38600c7f7499
MD5 19205bbd84800486883359de466c0dfe
SHA1 d14b251a341ad1900d74c09bd933b6941b73407f
SHA512 60bba364e4ba126fd436b1f490c4896a46b8842b9b59b78b33850aa21b1e694947213d3ae185bec279dd758148b62b83ec26a1a0ab3a5986cedfb84a3b94c93e
SSDEEP 384:EpiFiZcIesNA8TUNTUlIlr4zieOQe+CMOf2+iv+3Qe:vFQetwg+KzkOf2+imAe
TLSH
T15EC229F258E74876D9AE9787E77D2D138EBCC067B1856A80B3C85A1CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e66763f4b807b8c031568b2a973a7d6b90d752fb3cb8fa454423015e3e685765
MD5 2e47bcbf5facefc68b1057be95d722d5
SHA1 6f21d1746fd835490277910c71e132a3aaa5201e
SHA512 85310752bb2f44116ab013c182c794482a82015bf4279a5d2126bad512c4d48b5250a51d660b9d3cccb01aed42e2f3f88e92c46462a1e87c04da5c6e7b6447b3
SSDEEP 192:JONVh6v+YLNQmiUy6zZh+CGlOdmuus3EU6:JON/6vz/3Zh+CMONUU6
TLSH
T19702FA357D682CAB9FB2AE45F58737175FA8113BE6912F80D9D82E1C01D775C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f3bc82ffbd75813b6d35fd042b0a906ee04f0bc47f42e39e12fafd1e694ed7a0
MD5 9ade2cc841e0d0744baf736bb21634ca
SHA1 48c1100bd007aa9e0e97140f48c78c4e1d1f1186
SHA512 665dbeeffb3901c8df1a272aa50df12b788dcb04821e27c143d86692e2af7d3688ca22f79170a0f59fe1b8cb35adddf7dfba67ba28d14cd902f5a1c2d57fdba7
SSDEEP 192:gONp6v+YLFQmiUySzQh+CGlOdmcheRCHlqTU6:gONp6vzfhQh+CMOfZ+U6
TLSH
T194120935B8786C6B5EA3A584F48735139FA85237EA857FC0D5DC3E1C01DF69C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc4e2e46-7c7a-4f2f-916f-0058cfb7916a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc4e2e46-7c7a-4f2f-916f-0058cfb7916a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 754fa720fbbded6ebc682082e9533069ee2fe33362b1546bb76c141075fe2d52
MD5 a0ce4ca35879c43f9ef1835c732f380a
SHA1 6a59d2529ffbc94b81ffcc288a01d58a9ce203f1
SHA512 fb9fe3024f52cee7fdbc383fd7044652949e015cf3c61636f043e75566207fcff27ad3d7164cb15618fa7116b6bdd5687f10ad0549980282ccf4c8fe530c9244
TLSH
T10141E748B6FA1148B3B77F5AABF6686D487FBC371E06945D00110E4E0A67B40C872B77
MD5 SHA1 SHA512 TLSH

Submit Download