876766b4e80133fd490603e073d3567425b88794828a9292104244c9e40875ed

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xui2.0/src/bin/nginx_rtmp/html/50x.html
Size 497B
Sample260818-pg217stsbv
SHA256 876766b4e80133fd490603e073d3567425b88794828a9292104244c9e40875ed
MD5 5a719a793405561b1a13e6cb1f403d88
SHA1 835b9dec419c01420e78602527a9fba8c463521c
SHA512 81a2bb82a89a8e698a267fd925367ffa4bb4ee02e482d670835ae8621751605ce856fab051c9770e8e3cb94f63fb6dd03284affe4e1161f57c1bf9178b3da472
TLSH
T194F09E8EB210136B94210310AC86A6527206270812B7857479CAC9B2FAA6E12F9376E8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315292304402741"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{496DF245-D26E-4B6D-B9C3-B4059B1D7B7B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2700	4372	msedge.exe	83
PID 4372 wrote to memory of 3812	4372	msedge.exe	84
PID 4372 wrote to memory of 4048	4372	msedge.exe	85
PID 4372 wrote to memory of 4048	4372	msedge.exe	85
PID 4372 wrote to memory of 4048	4372	msedge.exe	85
PID 4372 wrote to memory of 4652	4372	msedge.exe	87
PID 4372 wrote to memory of 4652	4372	msedge.exe	87
PID 4372 wrote to memory of 1592	4372	msedge.exe	89
PID 4372 wrote to memory of 5108	4372	msedge.exe	88
PID 4372 wrote to memory of 1592	4372	msedge.exe	89
PID 4372 wrote to memory of 1592	4372	msedge.exe	89
PID 4372 wrote to memory of 5108	4372	msedge.exe	88
PID 4372 wrote to memory of 5108	4372	msedge.exe	88
PID 4372 wrote to memory of 2112	4372	msedge.exe	90
PID 4372 wrote to memory of 2112	4372	msedge.exe	90
PID 4372 wrote to memory of 2112	4372	msedge.exe	90
PID 4372 wrote to memory of 1016	4372	msedge.exe	91
PID 4372 wrote to memory of 1016	4372	msedge.exe	91
PID 4372 wrote to memory of 1016	4372	msedge.exe	91
PID 4372 wrote to memory of 4228	4372	msedge.exe	94
PID 4372 wrote to memory of 4448	4372	msedge.exe	95
PID 4372 wrote to memory of 4228	4372	msedge.exe	94
PID 4372 wrote to memory of 4448	4372	msedge.exe	95
PID 4372 wrote to memory of 5016	4372	msedge.exe	99
PID 4372 wrote to memory of 1544	4372	msedge.exe	109
PID 4372 wrote to memory of 416	4372	msedge.exe	110
PID 4372 wrote to memory of 896	4372	msedge.exe	111
PID 4372 wrote to memory of 3696	4372	msedge.exe	113
PID 4372 wrote to memory of 3696	4372	msedge.exe	113
PID 4372 wrote to memory of 2776	4372	msedge.exe	114
PID 4372 wrote to memory of 2776	4372	msedge.exe	114
PID 4372 wrote to memory of 2496	4372	msedge.exe	115
PID 4372 wrote to memory of 2496	4372	msedge.exe	115
PID 4372 wrote to memory of 4536	4372	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\xui2.0\src\bin\nginx_rtmp\html\50x.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84b19c188,0x7ff84b19c194,0x7ff84b19c1a0
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,12544984408108947558,7266652005299794043,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,5554135261347215359,13997750538905926707,262144 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,11946861653184465093,4950717273016108570,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1280620289139753631,13579229691204372007,2097152 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,8018217775754967907,5610776052933538866,2097152 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,13069659877918836726,8401483984718998326,2097152 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,15639853151827980028,4294988445156424442,2097152 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,16591208476045026723,1465463297706962263,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,14794346410277871020,5513172309837037490,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,18431167175223013902,15280434826221744035,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,18431167175223013902,15280434826221744035,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,16972390660916511807,14112091304952098926,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,382679973202954606,15406253327089555625,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,7865305305800914395,11085389114697327994,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,8629190962925061636,6098257926676355220,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,8399670015396031146,17701334812005184032,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,4430953913434738697,2825744632846237516,524288 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6416,i,1421860230724903152,8111738571930557650,262144 --field-trial-handle=2232,i,15641087002612495834,15667534536179262789,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 145B
SHA256 d4ebe35d25ee8d01e162018738ce5b195517eb5a27b24a03b1d3ccc78f95b89d
MD5 74479b8a71f72dd0ba1488e3b20793a5
SHA1 0a9a11c4847e98bbaa3babac7db420dc568cfc51
SHA512 e154b051e8a90abc97506935e8f6b2190d8663bf4f082d611e49ac39d79d72856cfa7145ee2f02562c482895d05f777347d3debe178aca9ad2d73879ab75bee6
TLSH
T1EDC02B4414DAC21FA614EC4F1328C70CC2C0360FD7C4B94F03C0C44C7442484E1A3964
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77d2a4639bba4039fd7ed42989f0dea16329d130413ff5331b2cd7a22b66d4b2
MD5 8cd630b735beafc88d4d2ed0adb10ae5
SHA1 0afc145ffa6807c9c863849aca7a759efcc868e8
SHA512 2e1bf80a1bdcb430b1a5b2bb505ffe59e5d346a7598ed87e582df29f30a4b945030e9671bfd436c036c85d260032d7b8f60baede5d9e0e915be9ee1424d232fb
TLSH
T1D56192340DDE66F5D761C4F298D10349307BC9E6F9335D4EF290DCBA2A867F1411812A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0abf789615780724d5b6a631ab802d68785e5884498d27028f3826e7af5c25c8
MD5 e4067066c43506e58d592e8b3fdc53cc
SHA1 5675aeae71ad2bca44e11b45a18934e7e5ac64bd
SHA512 0a4c4c2d103b1a8d7e1e6b256ef77c315f19526e05ef0d6fbba6485d0688f97e1b2bf69e232553f2fc84985d36c82d3090c66497aa3a6d8e458e2270cf68a00e
TLSH
T19E117DF3C7E5856E890116F06A24AE2BCE2D0505421C7C15C9D4FF2B93E3475E00159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cd93dda97f325125558ea9978602e013a6efb49be1e3dbbbb7715395ff5860d7
MD5 b149a9f7c76b769c760026a9544e30c5
SHA1 043bd2e356308ded983b7d852bf013310a11b712
SHA512 b5de409672e1b13aea53abee60e86242686fe27328ec832b8fec4ea2c69ce50593249dbf835b4307974cdba317dd17cbce8195b867f23cba46dbc63f686b1c3a
SSDEEP 192:sxZFRxkJ/f/sKG6IdpdyHW6+WNGYCkKra+rIgrJ:sxZF4J/f/sKGTwHbG/ak9
TLSH
T1D02297126E28A97B8CC7E31DBB15BF53D6F95032A1951E58EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a44183a901f41cdd1f98e3004e880d57c49e1ae1b1f8e30379013e3c8c66bd1a
MD5 95a15a35c9c34136182882f91141715b
SHA1 df633d06c89fbdfa1ea42f1576add0ac806ab545
SHA512 e37439669bf270b37943376ff2f041172b6be778647db0c33baf73c05ed37f841b6a97b5c5d1684300315e081e9de7f16e86b45ac49125b926588f1efa693ed7
SSDEEP 192:sxZFRxkJ/f/s6/6IdpdyHW6+WNGYCQEra+rIg5mJ:sxZF4J/f/s6/TwHbGXakw
TLSH
T19422B9126E28A9778CC7E31DBB15BF53E6F9503251951E58EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 09846b75372b1080959d465eb43febe3626357e8e454dfbc4784be37e2bd8c79
MD5 d99acc14a80a24c2cac5c0d4bfb026d0
SHA1 3b97cf4746a9028e0ecef4611d304071938bfd29
SHA512 387fe70893e80c133d27a55006b776cf1216cbee53037e1caf2c2ee7c805da004fcb8f2e4b6a5f7339baf42a3c38e7d1df01d9f7f35ffa5fde3c4b9fdf93325b
SSDEEP 192:sxZFRxkJ/f/s6G6IdpdyHW6+WNGYCkKra+rIg5EJ:sxZF4J/f/s6GTwHbG/aky
TLSH
T14C22B6126E28A97B8CC6E31DFB15BF53D6F95032A1951E58EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 db4940c15f68ca789053de4d998ecb67687c6c99bcfb469310b23cbf98ac1046
MD5 eedf256ddec1cbfa7cda57db9ec5152a
SHA1 6ea2136497f41e68537bb78b430e72a4f6b4e59a
SHA512 ee1305618b630364b6d68225bbb61798681f44bdaaeea51311ba6740a8a268613be91b76075360613fe49f63bba392957e7fe72eeaedbe3db1a672f9d1469e90
SSDEEP 768:66qbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrhror:66qbUj+WvSCs6u1jaaZLbWrar
TLSH
T188C2E83B240CCA7E4FC01E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a128f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a128f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9e04fee9228f5fcd4e0d900e8d6964a2c52a00af8a47b52afbc4dbdaf81e3dc2
MD5 85ae5314b562dfc5ac237e6418aa837b
SHA1 9aab019b3b0bdc8d5aaefc94e92edaf2b3528211
SHA512 614e152c1279a2cb9f1e775135caf04d833d5f06a8bbb29b7a2e450ea3cdf13977ac74a9541d3bb7bfc97820d0d10f18cedd8583c201b2a4c62184ccf706634e
SSDEEP 384:dZcIhsNMUKmG24raEa++d5icySllYJTfY81F7kauEBu7:FhXRa73icZuTH6xEBu7
TLSH
T1E0928E365C749C7759A6B158F84B36079FF8C07783CD6A90D9ED9F0E00DB5A8131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 aa1caf542d881f4f0a9167a592f18acfdaef235151af8e01a7fbf24fb1e736c6
MD5 8d8e00409e58500a0bb1017a1934fbfd
SHA1 83b78c8a8f9b28d8d81cb4773775df26bcd49ea6
SHA512 c157bef12afa990099125e42d2863ba45c2f0bcb957240bb5e30a54bfe42df18d0a93c0d46b02732089de8d306237721229dde25e2468eff7434f8c7c4ef02ff
SSDEEP 384:+ZcIhsNMUHmG24raEa++d5icySllYJTfY81F7kauEBu7:8hoRa73icZuTH6xEBu7
TLSH
T167929E365C749C7799AAB158F84B36079FF8C07783CD6A80D9ED9F0E00DB5A8131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d76bb531ad5220ac73a0680881c378fbe1138385397afa8c807c31912bad9a5b
MD5 cf68c7c2cf6de1594ddfe5cd35709994
SHA1 0b0d59d6df456dd48145c9edc8a257b24104365e
SHA512 b0439c7034091c8cb96cbe13b0c4b4a841a0f6026a20c96967ff443f9ec6ba689c430093d567360112f4807df6333e5ea864efe7ac6654c913fbe22497ba4d49
SSDEEP 192:vONR6Db6QmiUy8XHBa+j1+FdCKHRgbxU6:vONR6u9HBa++d5GFU6
TLSH
T13902E73568786CB79AF26E49F48737279FD4207BAA962B94DAD84F0C00D764C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 643e17e50c88b81aa85219145ead80619fbde304659ce29ed2e6d716178e2405
MD5 0a6208d8769803c9053082cde983722f
SHA1 2c63654fc92c39c0685db3cd3708a08196ea0010
SHA512 f57422bd3e1260253316c44ccde49b1858917017ebdead37039a115cdd444b980b9ff5ccd1b8bf834df2467171ea8c05d4060392bb69bbcc3425bea61681293c
SSDEEP 384:viFiZcIJsNN8TUNTUlIlHmG24raEa++d5tcySllYJTfY81F7kauEBu7:6FQJUwgbRa73tcZuTH6xEBu7
TLSH
T1F1A27E335C64D87BADAAAA44F84A36079FF48077C6D9AA90E6DD5F0E00DB19C131BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d43a5a1e574addf24265429cfa684e4ace3d38a941e33f2f082dd48646eb8278
MD5 b020bf48bc26bc03cd33d7c03acbb511
SHA1 b34b7466e1851e8e97d4b1638f44fdf053e28eac
SHA512 12ff18d8537af479caec42e09d26768fce30fd305dd1b620417ac2904c44e953572daf60dcfc3cc5eb8c761f9a62c49f00b6060b9fa40b2193cfc3751494918b
SSDEEP 192:EONW6DbrQmiUyvXGBa+j1+FdCK2YNzZqVU6:EONW61cGBa++d5rcU6
TLSH
T19C121A366878AC6B5ED27944F48736179EE491379A8A7F90E5DC5F0C00DB69C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c4ce68b842df2a1051c3ece928690de90cca06bd4a4b0b897e3d75ecd96ea4ba
MD5 2ec7dc4408c4ebf85185bf33266895b6
SHA1 2b88f30e07b2b9dc33e4fc4e6d26c7eec02ec32c
SHA512 10cadd2e61198c47d3368ff4852f6b3ddb77b62c57dac69a3c6b53a1116394a9e540ab7df72c7f3afe958d300b24adc17d64708616a2e0e462b05d3dc743fe62
TLSH
T155412A58A7ED1148B3B67F56AFF6946D887B7C371F0BD45D10110E4F4A22A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download