e5897b8e01ddae06bf10ae8951ee5279a7b64fbe7ac5bee07e030be8565b78b3

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/EULA/de_DE/license.html
Size 88KB
Sample260910-txhpqadr7z
SHA256 e5897b8e01ddae06bf10ae8951ee5279a7b64fbe7ac5bee07e030be8565b78b3
MD5 9a255533cfa70804ef7e9e0110ed95e2
SHA1 31b9dc3e278242bf46273d91fb9dc3cfdae7780d
SHA512 93de20fe65c741a61ec7e8fe45a83a14fe59d5afa4f48a5f80de1e9dd9266a454354fc930cb30810099cf02d966d6d4358fc59d122a7efc8adbf78ca694581e0
SSDEEP 1536:0Ay5LWMwA14tUa2jKcsYmVn7gfPyBzADuvOKphs8A3pGKVsJu76xuObh3:07dKcjUWa8C2AoRK
TLSH
T154932A91BCC91B2E928B73B6B301DEAA776CA379C3827055F29CD1B363864F0417D469
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335314831642968"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{84DD2A16-D372-4CF2-B9C1-5955B88987CF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4464	4848	msedge.exe	85
PID 4848 wrote to memory of 3288	4848	msedge.exe	87
PID 4848 wrote to memory of 4284	4848	msedge.exe	86
PID 4848 wrote to memory of 3288	4848	msedge.exe	87
PID 4848 wrote to memory of 3288	4848	msedge.exe	87
PID 4848 wrote to memory of 3556	4848	msedge.exe	89
PID 4848 wrote to memory of 3556	4848	msedge.exe	89
PID 4848 wrote to memory of 2244	4848	msedge.exe	91
PID 4848 wrote to memory of 2244	4848	msedge.exe	91
PID 4848 wrote to memory of 2244	4848	msedge.exe	91
PID 4848 wrote to memory of 1704	4848	msedge.exe	90
PID 4848 wrote to memory of 1704	4848	msedge.exe	90
PID 4848 wrote to memory of 1704	4848	msedge.exe	90
PID 4848 wrote to memory of 3044	4848	msedge.exe	92
PID 4848 wrote to memory of 3044	4848	msedge.exe	92
PID 4848 wrote to memory of 3044	4848	msedge.exe	92
PID 4848 wrote to memory of 844	4848	msedge.exe	93
PID 4848 wrote to memory of 844	4848	msedge.exe	93
PID 4848 wrote to memory of 844	4848	msedge.exe	93
PID 4848 wrote to memory of 4468	4848	msedge.exe	97
PID 4848 wrote to memory of 4468	4848	msedge.exe	97
PID 4848 wrote to memory of 1380	4848	msedge.exe	98
PID 4848 wrote to memory of 1380	4848	msedge.exe	98
PID 4848 wrote to memory of 1264	4848	msedge.exe	101
PID 4848 wrote to memory of 4960	4848	msedge.exe	104
PID 4848 wrote to memory of 5048	4848	msedge.exe	105
PID 4848 wrote to memory of 2276	4848	msedge.exe	106
PID 4848 wrote to memory of 4340	4848	msedge.exe	107
PID 4848 wrote to memory of 4340	4848	msedge.exe	107
PID 4848 wrote to memory of 2860	4848	msedge.exe	108
PID 4848 wrote to memory of 2860	4848	msedge.exe	108
PID 4848 wrote to memory of 1792	4848	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\assets\EULA\de_DE\license.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9b409c188,0x7ff9b409c194,0x7ff9b409c1a0
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,12154741264928095879,17781317654912221922,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,9896583831478818440,2611943061595075866,262144 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,2838551770495936813,15292183816845951193,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,14738969563118720587,9606631767243016900,2097152 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,798760822006265198,8832070143040324717,2097152 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,17493315213418681027,7062326821380355127,2097152 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,5070458311363847764,12927610612851515657,2097152 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14151954507474378005,3693548442846146468,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6795594407842130820,6308692868158536588,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,7385154135030538786,8429618790065556889,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,7385154135030538786,8429618790065556889,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,14497407140851146122,6272594248221198345,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,8529071519672311820,7186491273908507689,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,3225047269007488791,18030298709424894544,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,6334869126584917991,15763755076494735739,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,6908141430803297148,1916630070672681317,524288 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6240,i,13324728378300065769,714551830957657488,262144 --field-trial-handle=2412,i,14004096340340541686,3617611872704216353,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 228b6c05d6346959325cddf14b75160d5e75e27c8095f14b63c9152bc3beb8c2
MD5 d7020728e747d08bdc50cfd5d6292486
SHA1 4e303c94e6f57bdad88da174d69fbbe68ac27241
SHA512 31bb131b83f5da032d3470ec69438ad2f10426cac8f00ab0303362db5eb7971c2fd98e0f0b46f58aab5c963e597fbfade725c3c5ee29c70feccab5b1d4e822b2
TLSH
T10B61D63409E14B95E35133B083D2A5B0F8645ED8F917EE862390B87D4624B6FCF156E7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c8aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c8aa.TMP
Size 3KB
SHA256 ab3b28b1be6d39bc2dea61db3efd35df6fb6b617bd342f1419347057a9c298d9
MD5 b9c788cd10afeb7994df38103981fe3e
SHA1 7bf584d2c17897db1dcf3d4da6a83ea72b8452c9
SHA512 4b791d610cec91aae706923a617e2143adcbec94d967056239e3d1ad15d669fe7f619a0597c96c0f8fc043c980e3c96ca649b2b65d00dac59edbd31ee9830f45
TLSH
T13F61D63409E14B95E31133B083D2A5B0F4741ED8F916EE862390B8794624B6FCF156E7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 548ac2d36247398b87a096acaa79840dfb5d154358b7e020457c2dc536e86d0b
MD5 79450797bfce13c2078167a043abff25
SHA1 39e0395adcd7dd48e2669266a24235b5a598c369
SHA512 53724ef731ad5bc7b0b69dba670055262d1da7496447333866441efc70234984937edae16a7635dc244aa2d7b91747b51a33f53cd4aae20470ec3ea870844aab
TLSH
T159117DB3C7D585AE895156F05A28AE1BCE1D0906421C7C1989D4EF2793E3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 cfa85986fe53f430752e49c79f46ff1934b860795336f6fe504dd4970994d8c0
MD5 a6cbb8607d7c8636b2aee93ec83f8681
SHA1 9fc978ffa12f3e9a916c143a0e552a4655ca3dfa
SHA512 35ac37f9b02fb5a8db183e83a461cc1f051ec296513565219baf766ac1033deb13a438228dbd3451e4472dd79b871cc74e59afc80059dcc326ed349beeea351f
SSDEEP 192:sxZdRQWP/f/sZXIdpdIHW6+WNGYCkLrCnIgrJ:sxZdRP/f/sZ42HbGU49
TLSH
T1D422C7526E28A97B8CC7E21DBB15BF53E6F95032A1D41E58EAFC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b3003d2854fe11e7731bf93116fb277aa39ae5758837a3fc1a616086e895cc4e
MD5 8e8d82a680d4d4c0670d53562fb714c0
SHA1 b675a0f350a938248b592d6522d4a7e79b4abf8c
SHA512 146f3fb22284076debe92730d3a77d3b70953aeedf3a1c0e0210cfe39214e1ac1036ab6e3436d30ae1f18bd67ba60aab86773cee3e85e51ec7701b7f33af0ed5
SSDEEP 192:sxZdRQWP/f/sPXIdpHIHW6+WNGYCHwrCnIg5KJ:sxZdRP/f/sP4oHbGe48
TLSH
T15322C9526E28697B8CC7E21DFB15BF53E6F95032A1941E88E6FC861C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a0fb9e2923c5a5b47cfd6d54aa879f573f917d9d9c090bf9c75769ba2b929255
MD5 017524305905168f46dfd2440a5bef15
SHA1 d1b01f89136d9952e35fb071f826a69ec884a180
SHA512 46173a9fb2c423b3cfe18568d42cd6b72df795bc73a66000c63a5dff73e44bb2e1c25486b6c6921037fa70a739110c7d146afd9f9a7e885031a5afa2b8254f62
SSDEEP 192:sxZdRQWP/f/sPXIdpdIHW6+WNGYCnnrCnIg5KJ:sxZdRP/f/sP42HbGv48
TLSH
T16422D8526E28A97B8CC7E21DFB15BF43E6F95032A1951E88E6FC861C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 83f713dec5bffc690af8b5e32288cfa7a25890911154c6ded3b03a42085cf532
MD5 0d28309c2ab839081cfda6593421c355
SHA1 3a1a8950440fbd4572283cf6daf0f3750fc3baba
SHA512 cc26adc429460d952a5d32125833d67f43f123e87d02e7a7da0d9b7bd3c5beb012dbe661a8650df18b70acb4a6d9c2be9c5036dcffceef67f8eba77b1f8489d8
SSDEEP 192:sxZdRQWP/f/sEXIdpdIHW6+WNGYCkLrCnIg5oJ:sxZdRP/f/sE42HbGU4O
TLSH
T11722B7526E28A97B8CC7E21DBB15BF53E6F95032A1941E58A6FC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ff882ce301b125e96981fa157cf6445c4e75898a8acd31de9b18db2c58525245
MD5 6235b652ccd62b78a0bc0944f85ab55d
SHA1 e50d0212df32e2061009bf77e1178329309fc6ef
SHA512 33f9b54d3b54c4bb85efebe3c870b559e69290907fb6d44960a232efaff66e372532e06bc2b5673702b63dfaaf66bbcfa99dfdc7d6a313f5aeb8778a0aaef646
SSDEEP 768:w8qbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKr3roYTLd:w8qbUj+WvSCs6u1jaaZLbWrkALd
TLSH
T1ECC2E83B340CCA7E4FC01E9DDD5A6F972E9802C7AB588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3f9854420f922511eaaad4be7b32a6af574bfe9ae0eef2385bb6c6e6fd076818
MD5 06d860158425a1934802d77074f18677
SHA1 d58248f1cf35869882291deb3e2e52d15091bd9a
SHA512 d932439d1fb82f0758983562fd464375c22e9a5601e9198f082cc8ce3bc7b135ac750ccfd8fc56afdbc7d4306a9d094677200c94b5d738f80d651120ac61139a
SSDEEP 384:wZcIhsNK18aOEIvEa+fd4a1Lusa+VYUCof:Oh41zca6v1LuhgjCc
TLSH
T1ED828D326C785DBB54F7B655F84736175FF89063A6CE6A90C1DDDF0C00EA6A8130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be07542c78880960fea64ed5456db9ae878cd13d04026230e2b7da3f04ebad11
MD5 1cbe2d55dff8443a99d0dbc4bccaa035
SHA1 cf26a6492a5b051175e5ca623af6915a36093892
SHA512 a8352ccfebcecac9702976970c157adda433c48a1a51e42f0d97e3a436d48533a73645705025757b68ee68a9cfbf916077b36ef825afc0a86d077fcd6ca5eb88
SSDEEP 192:vONL6Db6QmiUy1dHBa+j4+FdCXmR2RgLziU6:vONL6uGHBa+fdFL+U6
TLSH
T1E602D73568786CBB9AE36E49F88737275FD4207BDA9A2B54D6D84F0C00D765C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 91a305f31d11fdd6c63e4702fd19fd0c334be82661451363140830f7b96f8a16
MD5 29681b29d8ef8644f56896188476b180
SHA1 3cc1cfcbe600c01dbe55a2356385fc06cc2639c4
SHA512 d0f17832b414224a6bedfff7d88fa35e452fdf1fe0e15c92fd82e9a262e6444f015e855d47cdbf3fd1ff2bad1b60ca3572f92b430e9080acc5933295dfd7a097
SSDEEP 384:8ZcIosNKk8aOEIvEa+fd4a6Lusa+VYUCof:qob1zca6v6LuhgjCc
TLSH
T16B828D326C785D7B54F7B295F84732035EF89063A6CE6A50C2DDDF0D00EA6A8230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 11f0cf85c68f81c3a405d1afb27e4a48bdc13679c6c8e85f362ee639d5c54511
MD5 3de623653cf34355d1408516ec360897
SHA1 b79537f4e6b089525b2791e47a7c33f6a7ee676e
SHA512 e0d27af9f8b086ba72f614df97e60bad06924c24695a624a04b2b2b99660aaaa5fa7ba9ab212604b7b7d7432cab548fa20c26002f03e18d2f57c3f2b6cc4f514
SSDEEP 384:BZcIhsNKk8aOEIvEa+fd4a1Lusa+VYUCof:Jhb1zca6v1LuhgjCc
TLSH
T1F8827D326C785D7B54F7B695F84736135FF89063A6CE6A50C2DDDF0D00EA6A8130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 51615cc78371b53a0d3ab60ea6fe44eaea9e378563bcf6f2064cf3de3f6f09fe
MD5 8f15d4726fdd1b6ead1a89c127b7100e
SHA1 17ea798453b0ee02b16f81b26e434f506394141d
SHA512 b2349c7f622f5241f5d77b1bb95fa5f8c7ffc90183ad0c7f8b12ab5cf865b43d03e5335c723cd1d9f0bda3bb85064ebfbe1de5ab57b47737c6a91713696a80b4
SSDEEP 192:mONL6Db5QmiUywdtBa+j4+FdCXmRy/FaXNzLTq5U6:mONL6fVtBa+fd4axLuU6
TLSH
T1F212093668686C7B5DE27954F88736139EE45127EA8F7B80D6DC5F0C00EB66C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5aaaf4a91211ad7363e71e2d369ad1bb48ac6bafdc3dda303fb08e851047ecba
MD5 8963e9142c0247cd2b3c456faf66b6a4
SHA1 880b4ced098f6e7683ae568b8374602a2b385008
SHA512 d7cef32abb2712c737b9206073807934961391865b8742d8dcfbc48751863b714ebd4afd96b05265230e295864d6c5547e7ceed78bf1f3c416d71979fc281615
TLSH
T10C41185CB6F91144B3B6BE0A9BF6A86E487F7D732E4A949D00110E4F4A62B41CC72733
MD5 SHA1 SHA512 TLSH

Submit Download