hxxp://ynnqhpg1ps2hlci2[.]smartmeter-online[.]de

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ynnqhpg1ps2hlci2.smartmeter-online.de
Sample260730-xsen2ser71

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299120096406511"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{EB67416A-F0DA-46A7-AC54-A6B528DF3F60}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4652	3800	msedge.exe	83
PID 3800 wrote to memory of 4988	3800	msedge.exe	84
PID 3800 wrote to memory of 768	3800	msedge.exe	85
PID 3800 wrote to memory of 768	3800	msedge.exe	85
PID 3800 wrote to memory of 768	3800	msedge.exe	85
PID 3800 wrote to memory of 5040	3800	msedge.exe	86
PID 3800 wrote to memory of 5040	3800	msedge.exe	86
PID 3800 wrote to memory of 4980	3800	msedge.exe	87
PID 3800 wrote to memory of 1164	3800	msedge.exe	88
PID 3800 wrote to memory of 4980	3800	msedge.exe	87
PID 3800 wrote to memory of 4980	3800	msedge.exe	87
PID 3800 wrote to memory of 1164	3800	msedge.exe	88
PID 3800 wrote to memory of 1164	3800	msedge.exe	88
PID 3800 wrote to memory of 2120	3800	msedge.exe	90
PID 3800 wrote to memory of 2332	3800	msedge.exe	91
PID 3800 wrote to memory of 2120	3800	msedge.exe	90
PID 3800 wrote to memory of 2120	3800	msedge.exe	90
PID 3800 wrote to memory of 2332	3800	msedge.exe	91
PID 3800 wrote to memory of 2332	3800	msedge.exe	91
PID 3800 wrote to memory of 4872	3800	msedge.exe	95
PID 3800 wrote to memory of 4872	3800	msedge.exe	95
PID 3800 wrote to memory of 4872	3800	msedge.exe	95
PID 3800 wrote to memory of 1952	3800	msedge.exe	96
PID 3800 wrote to memory of 1952	3800	msedge.exe	96
PID 3800 wrote to memory of 4276	3800	msedge.exe	97
PID 3800 wrote to memory of 4276	3800	msedge.exe	97
PID 3800 wrote to memory of 4408	3800	msedge.exe	99
PID 3800 wrote to memory of 2552	3800	msedge.exe	109
PID 3800 wrote to memory of 4432	3800	msedge.exe	110
PID 3800 wrote to memory of 5000	3800	msedge.exe	111
PID 3800 wrote to memory of 716	3800	msedge.exe	122
PID 3800 wrote to memory of 716	3800	msedge.exe	122
PID 3800 wrote to memory of 3784	3800	msedge.exe	125
PID 3800 wrote to memory of 3784	3800	msedge.exe	125
PID 3800 wrote to memory of 4220	3800	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ynnqhpg1ps2hlci2.smartmeter-online.de
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffeb6a2c188,0x7ffeb6a2c194,0x7ffeb6a2c1a0
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12692680939728169040,7782123244256965313,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,5562789526918839493,12769722900736371144,262144 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,13774317211137619859,12206964682532531831,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,3718524588792050833,14594903007516650524,2097152 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5546129903385918565,5730881683379034870,2097152 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12741577496919031284,7493030461499848899,2097152 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,14830524550202575259,14691337918447218719,2097152 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,67067203568001546,16026294077523016111,2097152 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,8260075783497826063,10513446892910051405,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,12220341420673699676,10410187361723145868,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,1575834019496075559,12667604087616056993,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,1575834019496075559,12667604087616056993,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,6774243099798044644,715269444090913154,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,14504156446163793910,1279185515301941693,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,17149965583968257972,17586163651453973740,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17494069942955566154,4590287478928997661,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,1450957361031691957,13394088802011668770,524288 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3684,i,4041134948775126436,18261674310741361114,262144 --field-trial-handle=2320,i,14815253310195211870,6382690849778290321,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0b18334e72e3ac835557b1dccb452d9cb954bbfe333534a21ec1ce89d537e7d1
MD5 65bbb2c2bd8892ce9a58639e55d29c9f
SHA1 645b1998383d21c72f4282b22d5ff0fbe0c5d3ed
SHA512 0a1a1b61f1b5bb3a59b9debe691617e29eab730a0b9e06121fb243da487c3edff1a3816d6ba0ac5dd11b172b282aba0a9873cb2d17c1d762d312a64068792118
TLSH
T11A61A6B40552096DD3671571D0D15500347086F9FBD3BE9782DCEABAEB37BA3805AB1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d4b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d4b0.TMP
Size 3KB
SHA256 4ec60a39a031dcc34862d29de4596f61ff5cbe47da29aae4139e99cae73903e9
MD5 698dc4608cddae0d5153b6065545d0fb
SHA1 ee8fcf1c26a1510715cd67b6f85bf3be905f9fbf
SHA512 412bbcc66aafcf1e45e0b774093589802430f3151ab74f4fc21eec00971e645bd25159e608ede609ede656fcdfba76f8ad9e66cf7a49915e226c926e296bcc16
TLSH
T1C761A6B40552052DD3671531D0D15500347486F9FBD3BE9782CCEABAEB37BA3845AB1C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 c9875cb31a3f1f671d21ea1d43566782927abddc3ca34278a55d4e6a51ad6350
MD5 8af13773bab29e84c23b55f20be749d8
SHA1 2e082f0624bd6a129261be9ce362a8be09ad6d8e
SHA512 a1911f43b95b01c9751a56add696499eee4f430a97822c64ca3f4bfe270c9c0bf1ccd6b3002d714c10865000a0ded9cf6290017f163c38aa9d777eb7423cfe3a
TLSH
T10B115BB3C3D5856E8A4116F06A24AE2BCE2D0506821C7D15C5D4EF2BD3E34B5E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c6ad1210f4cf20d8d1bdd7838f78507a99e8e3282b220b8d3d22425baf83f812
MD5 e09e70e190b5ef645c27f5a76b1be751
SHA1 b20011f31e15b774a140ce50a9b060076da33f2b
SHA512 a2b33bb08ac13aa5ec09a3c0dd6ec62c78947d3f6621794a3e2583084060d0311a701a712bfff1e0eac2818d06b2ed142d07a6d2708ffe215c9c87ab92e34a57
SSDEEP 192:sxZ/0RgyM/jK1Ml8Mke/fOsNi63YIdp8dHYM6+WNGY9IKINosIgrJ:sxZ/0GMe/fOsNi6ZAHKGNN9
TLSH
T18442E816AA345977CCDBE209F954BF53D6F90572E2940E54A9FCCA1C00E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9f12f12851131e9cc0ac53d6fc6c6bea84171096caa9e2888966c15938adaa25
MD5 b267cbbf27dd614d19fb16a73bbf05fc
SHA1 d6dc7bac8b6815cb7b8324d392222e3c57d4ae60
SHA512 812f74a4edf9bc37d2c56bbb75beeaff7ec8a9158ef46fb9b8d210b1529231ce79358de4914ca2fecdb88dae5284a30e9b9e9fe15afdcec8b9ffc3ad225b4592
SSDEEP 192:sxZ/0RgyM/jK1Ml8UQske/fOsSp63YIdpadHYM6+WNGY9IwLNosIg5fJ:sxZ/0Gq3e/fOsSp6ZmHKGqNr
TLSH
T13352E816AA345977CCDBE209F951BF93D6F54472E2900E54A9FCCA1C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a1095e2662126509be87220961ced6cde37f41adbad0a15e3cac3a8cc6d1f208
MD5 70be111d18a8e1bb31a1479f2c871f4f
SHA1 5ffe3fbf11650a011e2e95a695193debef6b0f95
SHA512 cd4f7580b4e29d5d14d246ad6028af44d43fe7298daacea9a80d195e3e43c1b3bb1814b6a3a16fbb595f29ea41bbd702920978b32e3914c1bedb438f49db757e
SSDEEP 768:gVcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNLroWg6P:gVcv21wWvu+Z+u1jaeFLeRN4Wf
TLSH
T195D20B2B280CCB7E4F841E9CED2A6F866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 77a311fec470de14907e43d6b60080af81e649ef85e6ae26d7fd67bc931d9d33
MD5 64b763686082fb4524426e1f47dee6e5
SHA1 da1dd339939b3d5594ca6c1bb96bf67017aa7c60
SHA512 3fc5fad1af69dd2b1e00b42d41d1d8df5f99d3f5cc6a9af254d05dfec4cd87859a003b6240ad7809814eb9d4d7f63f88d2cab9964371f7dc0f07443d1aeb5fef
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDOFWKeMTGsgKpKCg:mTZKHg
TLSH
T186916701323B0293397E780DA76685679E8132A3B869E57F7BB810624F67E121DFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4888b63dd563f3e890557bcc7378947cb2d4b8a32e2f2c952bba2a66231990f0
MD5 47022cafb13ef2df4dc12505a249a844
SHA1 80b97276fe22478f5f1fca365b02ab95f2e91273
SHA512 e44913e4f499da8765972f33c58480c977da60713e9058069e969172aa638ef692a973abdfff37d15d1281d81a5291cd0c0f82aa0c21f2d42d40cc0478447e7f
SSDEEP 384:xFiZcIPzsNcT8TUNTUlIlREhziTgpe+CrdhM7HOObjI9G6w7hU:xFQrfTwgWJwzE7H29MK
TLSH
T14CA27C339C68897BAEF6AA41F48A35138EF990B7D7996B90E2DCDF0D01974EC0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 41c50443cae50841d4bdc4b4683bccc211f98a5e2e21a76f548a41c5ea2aa92f
MD5 681f5413c63b5ba88395fc8a2a1d6183
SHA1 d86a4f5493d1bdb61073c7ae0116db0c1fe8e672
SHA512 9e3c2a7785b82878ae8f6659053c8ec4bde822b77a0e76e47ee25e90686c841b2d329a32bc100350ab759104993abe8c1190d54b54c5b3ecc676b221c8390209
SSDEEP 192:JONVu6v+YLNQmiUybkZh+CG5+FdeuIcusiXTK1U6:JONo6vz/xZh+Crdh3A2U6
TLSH
T1E002DA356D386CAB9BF2AE05F58736235FE82177EA952B50DAE81F1C00D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8cb23985e9e9b1dc420e0ce8b1fb464b4f4a76d2cd0271e676800b5a53a4128a
MD5 434708e26422ed3a1812e05d8124de80
SHA1 29a02b57824208321cabf1928bbb5c1223c6c923
SHA512 729a9d567d4072ad38828f1644db644826ac18efa0b33fb3746f4d726f6a4a8b859d6bbbcdceb4b11175b67deb9e21d596404e47a8816fd72708fed3459578a3
SSDEEP 384:GZcIhsNcBwEhziTgpe+CrdhMCHOObjI9G6w7hU:UhfzJwzECH29MK
TLSH
T193929E36AC381D7B9AE2A501F48739135FF89177E7C92F80E5ECDB0D06DA9AC0306819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 161c832b3b5bd44c925eb1d9bd0060e3c23b0b5187fce4a9fa0154e0445d64f8
MD5 8b9a5f72070c9464d8a022d265fa02fd
SHA1 431da58a990792b787754d215ce20d00980a39bc
SHA512 1dca0f4b991aa44ccc8031fdb400b58425f846f2080ddc3c8f1b8266ec1836e3f12fbdbdc226ec3c53933910d43223ca26a0941da1a4566eb7332e1ea3edcc7f
SSDEEP 192:DkONww6v+YLYzQmiUyhk6ch+CG5+FdeuInIEYCHi6rqYU6:4ONww6vzmpLh+CrdhM5HU6
TLSH
T16E12193668786C6B5EE27841F08335139FA95177EB8A3B90D5EC6F1C01DFAAC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d0936ec7f7a9164bdf74a85347f3fffdaf7142ca36ed70fe11e59adc31859cfc
MD5 6d8435155214612fc604be894bc4da84
SHA1 8f8d8ddee594e949f183a64b9b46ccfd8003e574
SHA512 0c6e5ba800bd0c8f10eb28718021d45bd92f913a75cdfc3d57d9f4fbd36128ddab32c0579e3d1430b605c6f5bc4f7c5df639929d8243ee125dfcd75a1ae71fa0
SSDEEP 384:0ZcIhsNcBREhziTgpe+CrdhMCHOObjI9G6w7hU:yhfSJwzECH29MK
TLSH
T188928E36AC381D7B9AE2B511F48739135FF99177E7C92F40A5ECDB0D06DA9AC0306819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f86e6f54-95e1-4620-8b4d-c66300a381a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f86e6f54-95e1-4620-8b4d-c66300a381a0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ba8908c2c33a28022c08530ccd29880d76483f0d8f9ca283567c325f4e4bd24b
MD5 61ff1b5fe3716efd5815a5e6e24cfb03
SHA1 143956f77cf80b40c776f732ad7c71d2b291fb6f
SHA512 71a09d784515676f00b230f51ef2293688bc48adc77976a000c8c7ead20b37fc59d691e60d2ea321d818591c0bbecb08d5d1acebc53b3381874988ba82604890
TLSH
T14F410758A6F91108B3B76E56ABF7A56D483EB9372F0BD45E10020D4F0A63A01CC62737
MD5 SHA1 SHA512 TLSH

Submit Download