fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xui2.0/src/bin/nginx/html/index.html
Size 615B
Sample260818-pg217stsbv
SHA256 fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de
MD5 7df3d7cf3358af3f470ac7229387ef94
SHA1 c51a3f0e6de4eb802d5630941c3fd9e1d0efae4b
SHA512 098db3badb76a319c211d685b869e15bbc51e2658a912514b253d2a5ef3a61981dad1726f1ccb494f21b7869e655b88446c5c5c91fd76d4e33885a0b5aef3bad
TLSH
T152F0029BE3002227B48343013CB35A21775503E40354CB5578C74DD3EF2A913F4175B8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4280	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315292327467040"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{12655C44-6F42-4D01-AA26-52C5E4C5A9FE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 2528	3772	msedge.exe	86
PID 3772 wrote to memory of 4280	3772	msedge.exe	87
PID 3772 wrote to memory of 4368	3772	msedge.exe	88
PID 3772 wrote to memory of 1752	3772	msedge.exe	89
PID 3772 wrote to memory of 4368	3772	msedge.exe	88
PID 3772 wrote to memory of 1752	3772	msedge.exe	89
PID 3772 wrote to memory of 1752	3772	msedge.exe	89
PID 3772 wrote to memory of 2396	3772	msedge.exe	90
PID 3772 wrote to memory of 2396	3772	msedge.exe	90
PID 3772 wrote to memory of 2396	3772	msedge.exe	90
PID 3772 wrote to memory of 4892	3772	msedge.exe	91
PID 3772 wrote to memory of 4892	3772	msedge.exe	91
PID 3772 wrote to memory of 4892	3772	msedge.exe	91
PID 3772 wrote to memory of 1820	3772	msedge.exe	93
PID 3772 wrote to memory of 3336	3772	msedge.exe	94
PID 3772 wrote to memory of 1820	3772	msedge.exe	93
PID 3772 wrote to memory of 1820	3772	msedge.exe	93
PID 3772 wrote to memory of 3336	3772	msedge.exe	94
PID 3772 wrote to memory of 3336	3772	msedge.exe	94
PID 3772 wrote to memory of 2424	3772	msedge.exe	97
PID 3772 wrote to memory of 4984	3772	msedge.exe	98
PID 3772 wrote to memory of 2424	3772	msedge.exe	97
PID 3772 wrote to memory of 4984	3772	msedge.exe	98
PID 3772 wrote to memory of 1512	3772	msedge.exe	100
PID 3772 wrote to memory of 4300	3772	msedge.exe	113
PID 3772 wrote to memory of 4876	3772	msedge.exe	114
PID 3772 wrote to memory of 1952	3772	msedge.exe	115
PID 3772 wrote to memory of 3888	3772	msedge.exe	118
PID 3772 wrote to memory of 3888	3772	msedge.exe	118
PID 3772 wrote to memory of 3348	3772	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\xui2.0\src\bin\nginx\html\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe5b86c188,0x7ffe5b86c194,0x7ffe5b86c1a0
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,12579902129436512433,14674650502109130194,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,2127745124233448841,13835019514363106616,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,14267897682155517147,10109617684675609717,262144 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,3986418687820784278,14947162862430098653,2097152 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,11488868268808932601,6204499957497456005,2097152 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,9461644056799502583,7985621631577075458,2097152 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,8485458592603218340,14062450296654462915,2097152 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14347834057368653169,93552893412675490,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8749082609306909383,3753133710502433617,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,10946318769173317601,10124221339078069951,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,10946318769173317601,10124221339078069951,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,14192006358498075228,2341747866118575661,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,9267600040915128491,7051176610536922758,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,7342850279153381814,11172867954630361002,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,7233166099896038768,15547324271624743370,524288 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,14159250631081741360,9553445653493633296,262144 --field-trial-handle=2492,i,8605981747331483267,1378412780997993177,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cd3fc096a0c1f4abb9359a82fcc139397cc0e6d5cb03ed43d03fbca92a3836d0
MD5 976b7fbc407a65e6ade4fc7310cf3f4b
SHA1 2abeb0c3a598b22a9c91da683b4a41ccb4ab0f12
SHA512 76651929bf470a13e18c91cb2d7c3a86afa795af6f96ede5b7b7cc4a8f0fbeb6267396a60882a420ec7133dadfb8258ecde10fb9790af7b6fd8a3c6d042d9711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T10EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9a85eeacacc4d90ccc51afad3ddd9907fe95490eec76b24776582e56c9a762e
MD5 5c720092dc1ec05bb1ae2c35a9c28a30
SHA1 f0036418297be655d21cc9b1cf4c5bdaf3fa87f4
SHA512 439093e4afd80cfa6e44658afc4f926385e7e9a736b8b3fb0fbcb3a5e97e868b99eec8e4272bbee24c3460a1bed43576fbe56d037b9e9a4f65342f1144ecda95
TLSH
T1A671F9785E4708A5D713A0B375D252C032318AF7F426EAB1C16D68B0660776BDF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588577.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588577.TMP
Size 3KB
SHA256 7bfe93e97dd14dc9fa8222c37d21c5a524e89baf58c5568085e04272af2c62b6
MD5 979416cead1d249c476435a94c178e66
SHA1 8873de0494b69996f7a4f0543aeac5e63a8c6db8
SHA512 0b8a2f41ca6d0ff95c3e6e5623b3058bd2c1e65dd93e65e837f2a200fc3cdbf6bfecab4bb3713cda5ac20a9c116237ceacf962bd5f6cdfd213df144c6be42c53
TLSH
T18171F9785E4708A5D713A0B379D252C032318AF7F426EAB1C16D58B0660776BDF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 a2cb762b361c374db40ce36d7fc7751777094ed6360c8767cd0d6d18b5bea38b
MD5 026ec53934177e38baec4f418b2714da
SHA1 3e769bdaa020625c4522f9e68d264339613bc166
SHA512 66124fc28116121b9dfd9e83976fed6d739a37981583ba3f48834e02b2ac7bd837591e9eacfe596390d259972fddaaccadf1ef961249f94e61bd00f6a242f024
TLSH
T1BB0190F3C3D4956E8A0052F06614AE1BCF2D0942431C7C56C5D4EE2BD3E3475D00189F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cd6433dc6e57cafedcb714c073c575bc3cddacf4d54066c5d6c3c01ba6295a1d
MD5 2995ee34b196cca3ea199de19e459ff3
SHA1 1ba0e7e362ee32b36c0dcbe045f625b5800f8fb2
SHA512 a7bfcc9a152c97aef4b0ed340200bc644e9febb7db419c54b06aa86cc50470385017c02abbebe76169c8f5d0bbb17e4d580370c65d42e5c1b93efbc3a5b633e6
SSDEEP 192:sxZmR0yM/jK1Ml8Mk0/ffsJw+IdpduHW6+WNGYIkkt+CIgrJ:sxZm6M0/ffsJwv4HbGVF9
TLSH
T11842F811AA34A977CCDBD309FA457F53D6F85472A2940E44A9FCCA1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 01d9692a7f277e07818344549b2b44f1c8026a86cbdd8bbb7ab2a78d88de8239
MD5 f3873afde01d7bb793f93f7e75ae91cb
SHA1 9b7c6e63eb6cb2030927b5bfa89a5c6e0aac9168
SHA512 bd293e7697d2c3e8c936ca76796dd2809e2c9bce6914075cee03526571294036aeb4d97473138fb93ebe6cf569091e3c33812d6837f7311ba3403bea19501e31
SSDEEP 192:sxZmR0yM/jK1Ml8UQ9k0/ffsrl+IdpHuHW6+WNGYIePO+CIg5/J:sxZm6qW0/ffsrlvOHbG7Fn
TLSH
T1EB52F716AA34A977CCDBE309FA45BF53D6F4547292940E44A9FCCA1C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 08718ec25c5baabee8522532e83eca7b6360b8c261ecf73f5bb328739357cc9e
MD5 c83dc96273b75cc3bc93cc9f397fb0c6
SHA1 0d2f3539abdf83e94430f9cfa3cbd4bf9a25deb8
SHA512 eec547386e54b21944b616a5554e2ae6b283e829832ab07f37a01f2d4ff5b5b74b8cdfd9555ac9dcff55aeb72f3d2566ee769facfd7a23369753daaffec507cf
SSDEEP 768:T3sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9sro1c6:T3sqxXlWvJD6Tu1ja54LAs931D
TLSH
T10BD21B3B694CC77E4F840E6DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5f68ab826e303ca9594c2b9b84ee25f751c10a80283825f0b97ec224b183faed
MD5 408007faf8d8883cc8133f61dc426d1c
SHA1 ccedceb31de836631a5bd682e11994bb2ca02e72
SHA512 2cf68c4ddc19556a3c1217285c8b718ae0120351304f023cd14cc8ba4e3141a7fc2847bfde648c8ea5d14fa6104b7ebc66fb72e867ee3b93d79689cc5f0c23c6
SSDEEP 96:KYbaKYIKSogKteiCQQKp2SAgKdG6Wh2KKgq:Exb7j+rtL
TLSH
T1CDE13946B13B220338BD2948A36696769E4172B33418A86F7FB841725E77E214DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5923e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5923e9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1cdf17a7a07d1212bef84fd395bd4de353446d5c36619a5ce041d6e4f01788f5
MD5 16b819d5fd74ca7391e32a92c1ab57c2
SHA1 686aa64ab97ea4e5dd8bc51d7d9a2920ad371b52
SHA512 5a72fddb59f3f38ee86d964f2e82b5da4a9792d42dd82ed15db7e3114d868130a29f5d323f579e6a0502b40117ad543bc37f862b89542e3deca655d2fce5f2d3
SSDEEP 384:6y3yFaeO8WsN/UVIgbr9GfVRN+Oi+p9far2Yq9m6BMMj5kP/:V3IzhWVENH+Ois9faaX9m6yMS
TLSH
T134927C36BC346C7BAEA36501A54B3217AFB4907B95C83F94E5DD6F0E01CB59C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75b6b75b5eecedb62615ea6f807463089dcd228fb72bc393ee712e4e6471829b
MD5 47f22533b0eedee002dd5703c847d4a6
SHA1 a68bc40c38fa6e77cd785b78eddeaee826dee286
SHA512 44c9e40b85a308e65cddbb7e6f26798f124f548a27277036002859db6a896528dd5c55e21b47bcfb6dc24edaf02b4cc5061cb559ebd04657f0bc4d8e4c7c9815
SSDEEP 192:tONd6JkRtQmiUyrpW+RN+OmJ+Nh3KRCU6:tONd6UreW+RN+Oi+3zU6
TLSH
T1C502D835AD382C7B8EF26E05B48B27175FA8203BFA856F84D6D81F0C01D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 7a0d872b2c69173be1c62d73a6354ac263351d23f52b3940b5b78e37f03db816
MD5 2d817703e68c276bea54abfbf338cdf2
SHA1 9a1990eaf2a54040ae938bbda399032460171b1b
SHA512 b83ff99086aae99860e1a02a173332283b255989d397971b4fcdf5d5a29f70483cea036cd2d94129ea8053543962a1a7941d64d18100927537d660de818eb5fc
SSDEEP 384:y9iFZ3yFaeO8usN08TUNTUlIl4Igbr9GfVRN+Oi+p96ar2Yq9m6BMMj5kP/:JFZ3Izhu5wg2ENH+Ois96aaX9m6yMS
TLSH
T14BA26B37A8649D7BAEA66A41E64B3217EFB4407BC9C47AA0E6C95F0E01CB19C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fe801527bb5b7e794a1b6d64f5ea31c79d3bf08222169d359a332ff4489f20df
MD5 7eb15f5063cbb2c42c30b50ecf7e6929
SHA1 cdcd026404e6c763e3efe679612a47ff71cb9c8a
SHA512 8187802d38435b867c611072855d68dc1aa0bb9d3fac1e3cdfd7bb5daa44a4f5a0b72bd8c87473f60ecc58619a2806cd340fb2e6aad606287ee6b3aaf88a1196
SSDEEP 384:6y3yFaeO8WsN/U4Igbr9GfVRN+Oi+p9far2Yq9m6BMMj5kP/:V3IzhW4ENH+Ois9faaX9m6yMS
TLSH
T168927C36B8346C7BAEA36541B54B3217AFB4903B95C82F94E5DD6F0E01CB59C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 11e5b49566e45db637cd8de058fe3023661afa1cc4c910e592c9c29b61d1fcd8
MD5 49dab2a02d93d2dfebb65610e18cff38
SHA1 29a6b3a17398321ae2e96412908cfba53ff44a4f
SHA512 a90d07097441d410c074b9addc8f2c712d0cab07548b26b04a4a4fcca030ea27601efd64426061824d50c95e36950568cd6c0bcd3a6061b59733a445534a8c41
SSDEEP 192:F2ONd6JkRyyQmiUyDp9+RN+OmJ+KG9aVcfqyYU6:F2ONd6Uyus9+RN+Oi+p9NaU6
TLSH
T134122A36B8786C775EE36941F48B31178FA85137EA896F90D5DC2F1C01DFA9C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ffa536c-6dc1-4230-b05d-ecd4ad125846.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4ffa536c-6dc1-4230-b05d-ecd4ad125846.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e1225d9acd69296aaa664c0beb28bc2d9975939198a7c15d3e4ccc17ce64f038
MD5 da5acfeaf8d43d9cbbc9065b4cafa48f
SHA1 2cb401c5a0d867a16e480d18a38dccd5cbbe4b4e
SHA512 4600855c696e202a82a4d245c6ec606b0beef1d97a2f72eeb3a64659a97591432c4af92777728e7206fdbd3651b0f58951b8335faa742bf02374ca64c03c3cd5
TLSH
T13F41285CA6E91148B3B76E5A9BF6686E447FBD672E1BC55D10010E8F0A23B80CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download