5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-527357-ylxovn.htm
Size 194B
Sample260930-2ntpmatfkd
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4848	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{F5FB06CC-11E5-4423-A313-737E62BD654A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1632	632	msedge.exe	85
PID 632 wrote to memory of 4848	632	msedge.exe	86
PID 632 wrote to memory of 2924	632	msedge.exe	87
PID 632 wrote to memory of 2924	632	msedge.exe	87
PID 632 wrote to memory of 2924	632	msedge.exe	87
PID 632 wrote to memory of 4956	632	msedge.exe	88
PID 632 wrote to memory of 4956	632	msedge.exe	88
PID 632 wrote to memory of 2012	632	msedge.exe	89
PID 632 wrote to memory of 2012	632	msedge.exe	89
PID 632 wrote to memory of 2012	632	msedge.exe	89
PID 632 wrote to memory of 1968	632	msedge.exe	90
PID 632 wrote to memory of 1968	632	msedge.exe	90
PID 632 wrote to memory of 1968	632	msedge.exe	90
PID 632 wrote to memory of 1088	632	msedge.exe	92
PID 632 wrote to memory of 1088	632	msedge.exe	92
PID 632 wrote to memory of 1088	632	msedge.exe	92
PID 632 wrote to memory of 2340	632	msedge.exe	93
PID 632 wrote to memory of 2340	632	msedge.exe	93
PID 632 wrote to memory of 2340	632	msedge.exe	93
PID 632 wrote to memory of 3960	632	msedge.exe	97
PID 632 wrote to memory of 3960	632	msedge.exe	97
PID 632 wrote to memory of 3300	632	msedge.exe	98
PID 632 wrote to memory of 3300	632	msedge.exe	98
PID 632 wrote to memory of 5036	632	msedge.exe	102
PID 632 wrote to memory of 4992	632	msedge.exe	112
PID 632 wrote to memory of 1892	632	msedge.exe	113
PID 632 wrote to memory of 3692	632	msedge.exe	114
PID 632 wrote to memory of 4224	632	msedge.exe	121
PID 632 wrote to memory of 4224	632	msedge.exe	121
PID 632 wrote to memory of 1056	632	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-527357-ylxovn.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff952b6c188,0x7ff952b6c194,0x7ff952b6c1a0
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,16571150318971972439,16554792875420427035,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15490362491862054051,3825285351116114940,262144 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,16092668247442016815,13268483193479670904,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,632624317039638651,15450171107536015437,2097152 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,11888623648151548463,3306126504826407878,2097152 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7883283037324013803,13631987347935943961,2097152 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,11395384459585932782,2277803183977169081,2097152 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,5566131268446451148,6167339347079822793,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,16760972155297148252,9577812654849511089,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12331161044576830910,3984498218391781093,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12331161044576830910,3984498218391781093,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,1566692631301732341,16876063744647599489,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,4666893270400126962,5566492262011514161,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,4958773584834470607,13500727209383591192,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,5015436010497209887,5791372507578839613,524288 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2080,i,3315362985351499599,16838467644756613939,262144 --field-trial-handle=2204,i,3741185363213444338,10872905272042545131,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

1f8298f1-a8f1-4d4c-8468-c1294a464632.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f8298f1-a8f1-4d4c-8468-c1294a464632.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fb5c8fc9729ebc870fccb37e9004152329939174a27d11216bcd17972c8edc98
MD5 3ab7b0858e826b8e9096f8505b9d7153
SHA1 cab961c458c1d25b7d7b4edcf64de0d3aa9f4d7f
SHA512 367f267774971f69af0af454ac7622e525be0a75dd41461c46530c19b52a97489b3b74c059abc2cbc792d1d28d872c6543d8c956b51cae07b4529f93d94dc3ad
TLSH
T1B661B581228783BEFBB7647481DE11CF3E3558C9198B2F22C4E5E578B88F765A31911B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a488.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a488.TMP
Size 3KB
SHA256 8a4dda33e5730172bcd5fdd0d8f24434a1de5de9f311fab6755a617ccf18b887
MD5 fa1238feb6a634e0f1fc889777a64562
SHA1 4fd85abb61ecca19dcc6d3a128b2c283782d6e44
SHA512 a106651ceee02834b562ae7a706ee11e4e3eccedeac7fae664a2b4ee92e41fd83e00b56d6114143a8ec1bdfc6fa764055c76101f87295377d9e17cca196d5a58
TLSH
T1A061C580228783BEFBB3607481DE11CF3E3458C9188B2F22C4E5D578B88F755A31811B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 7039aea90761c04cb3ed5964b1d96b52d3a982583661975c18ec65cdadf81b4d
MD5 0a7f543786e15c2720c2d67eb1b4a1c5
SHA1 342be9da75d7d1f2a6b09c5477c0fc682bbfd41b
SHA512 ab46954168474e08a4ab2b2e340fb3816f347dc01b06ebbb79a22b4d4adb6e24b2ef131a37ae1c3761ad395d7966f40182d37cb815cf1674b1a8b1e5f1f96934
TLSH
T19E019CF3C3E499AE8A0057F06A18AE1BCE2D0542431C7C2AD5D4AE2B93E34B5E10189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1399b539fea5146271d247d4187dfa6e394a13099205c275537948b31521e66d
MD5 6d5299369409c3a2b500299cce1c57b0
SHA1 893d41302db9667818f5d628c97c769326578ceb
SHA512 ea31c26f9d4dd55ade82d0fcd23cfe166b7f44b31eb6e962453dd1f40e2c16fb4b75408616beef24d7b244b3e7149aa5b851da2c263a0bac365199af3cc91b58
SSDEEP 192:sxZfRRW9/ftXsR1HIdpdlHW6+WNGYgUZ5aIgrJ:sxZfG9/flsR1IHHbGR9
TLSH
T12612B7526E28A97B8CC7D20DBB25BF53D6F9503291D51E58EAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 447939270badb1546f6238dedc956a82b8653caf261ebc92f32a79585336d422
MD5 ad738f6ae48c39bfa33221b4f0cdac9b
SHA1 a259ffb2dd62a6915d7b0d6a0d03d996daa2f9e1
SHA512 9e1b85c6794b48f70778152ab074cdddda7b9ae2f0341352fdd5f5582a7863d6e4b0b68a8f6c54d003ec606f09e0d0315cd69cc0eb97f4409db765a31c1f7951
SSDEEP 192:sxZfRRW9/ftXsPcHIdpHlHW6+WNGYgLZ5aIg5nJ:sxZfG9/flsPcIFHbGAL
TLSH
T1BB22B7526E68A97B8CC7D20DBB15BF53E6F9503291D11E48AAFCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cd15564ba47e26cb0e88e1f3621981c23c78e5143b6ca346e949c3b27d74cf36
MD5 cb06fc50b31cb0cf3ccc8e7687e0675c
SHA1 059a9ac2f5e9813159a0f8064a1b663242ed1850
SHA512 9796dae871618876fdf2fe6189d874aea3ad83960b131908b1e859f0456a25f6dd3e065bd7928d457d2c819ccca42077f468b728113561e359bbace8bb3425e9
SSDEEP 192:sxZfRRW9/ftXsPcHIdpdlHW6+WNGYgHZ5aIg5nJ:sxZfG9/flsPcIHHbGoL
TLSH
T1D022B8516E68A97B8CC7E20DBB15BF53E6F9503291D51E48AAFCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a78b8b9d233b72f677a66e7e6b3bec6a0d235508c950fc9a940927453f90df79
MD5 574acfa6735e56c0972543cea31618c7
SHA1 89b2b903d6b58f9c4bed0ec461245de4d337fc75
SHA512 9763193b5631aef789ade727a29f2cc377e29ce180cbc07c0991245dd990461b766ad204c28ac218f85537caa607844bb50790f50a7deb7d981461cab1d52bf8
SSDEEP 192:sxZfRRW9/ftXsP1HIdpdlHW6+WNGYgUZ5aIg5NJ:sxZfG9/flsP1IHHbGRl
TLSH
T1EE22B6526E38A97B8CC7D20DBB25BF53D6F9503291D51E48AAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b541a2f56ba9952eff71e9fe789f0a51805c5c773f408e21e036ff47bda94b2a
MD5 ffa4d72bd8d475b2a0a9d7f4d0a0f5ff
SHA1 180d7834f795e2c11146f98a18ba9bb5699355b5
SHA512 06dffebc9c5ed703fea83898ff9d77b469c1805040bef4c6e6e5d9deb83d6ebd7a073da9fce51a3dd19d5290ffd89e170b1b17edcbdd7545acf19527f51b024d
SSDEEP 768:lyichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz6roouf2:lyichfPWvPZplu1jan+LKgzxFf2
TLSH
T11CC2FA3B644CCB7E4FC01E9DDD1A6F967E9802C7AA588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593eb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593eb5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1b7b21ab8438630b98ea87d1d837246546b370771eae9f3ef7bee4774b757845
MD5 42d04b4d7a54ac103c56bc7cfb649376
SHA1 af89e8d682f85fc3e181078c3f83d79177375c6e
SHA512 7e089ffc105e6347a3e2abb245806bf1e1334aa5217a27cc90db85fc2dec99bcc04b3da288ade0de779223b5f2f2665f6a537156ee3d833ad3e653b213eca715
SSDEEP 384:vZcIhsNSBuN+5++fyBGYX5EGQUFj3tgOIwZOyFLFoG:nhyc5cGYuGQC3Xsyxl
TLSH
T1C2828D329CB8ACBB6CEBA185F54B3A035FB89027D7C4AF9495ED571C00EA198131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ffb0e8e7c6def4ce55b42e8cd0611f8eb018da8406c7d906b88d17b4d344150d
MD5 8ce53a71b17de316e8691b4dc8cdb0b5
SHA1 a908be4cbafd5b0722cda97cd7e51c3cd646caff
SHA512 11d53b0764088ca8e134c65c3ae0a71b0abd230134a685628074a736f80706283b3a61feed65aec793039c472ede6f475ff7ddd28d2548fea15a59898d80c0b7
SSDEEP 384:CiFiZcITqzsNq8TUNTUlIlAuN+5++fyBGYX5EGQUF53tgOIwZOyFLFoG:JFQ+jwgbc5cGYuGQa3Xsyxl
TLSH
T198A25C338CF8D8BBADEB9A85F54B36038FB44167C6C5EB94A6DD5A1C009A1D8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8681380356c2d683ec6d25b2e46624ac31f9823dff00fe74d4b57e2abede1efc
MD5 d81ecb05e86e364b76ea025ef77a255e
SHA1 48ba3868c07b3a3cec91d61c4037e8c20c2862d9
SHA512 e1f5d315cdc167dca74d7185af0bf70f4408939da7bbd7e6d0221d479178effba94ae3404147192b4952c62b8d0df8a7ccf690555d052b4956a6dbfdc00c0c08
SSDEEP 192:LJONC6DphmqQmiUyQVq8wGYX59ezHC6mEkk7DaU6:lONC619VRwGYX5EG62U6
TLSH
T1AE02D935ECB8BC7B5DE3AE45B44B2B135F98112BAA916F84D6E81A1C01D764C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fbcb053f5a1f6397b6d93d99e865512c03e5a0fe79a9bbf377ed0d18d82da746
MD5 af097728d8ab1a230328cead02d6d71d
SHA1 2bb13b1ddae2f8d55edb4992ebc263218ae44989
SHA512 3a13267a7f6f98fe2a8ff905184d9724af422ebb93ae5bd20498e61fc60ce27f0c3617f4c7049faa65b7cf5588913c30e11570fb14bcb216b7d51cc45d959ce9
SSDEEP 192:LJONb6DphWqQmiUyCVuwGYX59ezHC6m4Une+wkIIlq5uzU6:lONb61dNuwGYX5EGQUF53U6
TLSH
T1A9120936E8B8BC6B5DD3A495B48735135FA85227EB857F80D6EC1A1C01DF19C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4fdad7345f6e5be15b4ff3f89dec348289d6597168f87c0e89a6b853c841c63d
MD5 54003f10cf1b4cd9f5d7ab567c228c0b
SHA1 9052544745acf2bbdfa88e6e9732f35956fca4c6
SHA512 4756ba39a0872d3ad9adbd5d004ae2376ed4ca071d1dc62a4d767f64aee445eceb5e96a91849d6e185df3cc86421b8d2212d413a040a2139495aa34ba38a5a85
SSDEEP 384:8ZcIhsNSAuN+5++fyBGYX5EGQUFj3tgOIwZOyFLFoG:qhfc5cGYuGQC3Xsyxl
TLSH
T1EE829E329CB8ACBB6CEBA180F5473A035FB89027D7C8AF9095ED571C00DA198130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0926724-66ac-4f31-bac8-51879d2c1f26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b0926724-66ac-4f31-bac8-51879d2c1f26.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 881687e5b8fb7e1a0a2095d61fbddda1a3d711900dc42cdf0a7d39da196f7b51
MD5 7d97f8510f6c1b6b9f0f04f0fe9eb8cc
SHA1 1d369d13758ff7b576dbbbc0f36a9049597c04ac
SHA512 4f1fddc54706ae722a38b821eb3c14d49583018ace5904ed4ef8a9377bb085e3d7d8ed7cf00874524206d203c6dbdf280495016bddd58bd9c7f453ecc3b5394b
TLSH
T14E414D5CA6E91148B3B76E0A9BF6B86E447B7D772F06D49E10100E4F0662A40D9F1B37
MD5 SHA1 SHA512 TLSH

Submit Download