fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xui2.0/src/bin/nginx_rtmp/html/index.html
Size 615B
Sample260818-pg217stsbv
SHA256 fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de
MD5 7df3d7cf3358af3f470ac7229387ef94
SHA1 c51a3f0e6de4eb802d5630941c3fd9e1d0efae4b
SHA512 098db3badb76a319c211d685b869e15bbc51e2658a912514b253d2a5ef3a61981dad1726f1ccb494f21b7869e655b88446c5c5c91fd76d4e33885a0b5aef3bad
TLSH
T152F0029BE3002227B48343013CB35A21775503E40354CB5578C74DD3EF2A913F4175B8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315292342423148"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D9081BDE-D259-4306-A863-40C4DE67AE95}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 1940	3352	msedge.exe	82
PID 3352 wrote to memory of 2724	3352	msedge.exe	83
PID 3352 wrote to memory of 608	3352	msedge.exe	85
PID 3352 wrote to memory of 4156	3352	msedge.exe	84
PID 3352 wrote to memory of 4156	3352	msedge.exe	84
PID 3352 wrote to memory of 4156	3352	msedge.exe	84
PID 3352 wrote to memory of 608	3352	msedge.exe	85
PID 3352 wrote to memory of 2532	3352	msedge.exe	86
PID 3352 wrote to memory of 2532	3352	msedge.exe	86
PID 3352 wrote to memory of 1968	3352	msedge.exe	87
PID 3352 wrote to memory of 2532	3352	msedge.exe	86
PID 3352 wrote to memory of 1968	3352	msedge.exe	87
PID 3352 wrote to memory of 1968	3352	msedge.exe	87
PID 3352 wrote to memory of 4312	3352	msedge.exe	89
PID 3352 wrote to memory of 3508	3352	msedge.exe	90
PID 3352 wrote to memory of 4312	3352	msedge.exe	89
PID 3352 wrote to memory of 4312	3352	msedge.exe	89
PID 3352 wrote to memory of 3508	3352	msedge.exe	90
PID 3352 wrote to memory of 3508	3352	msedge.exe	90
PID 3352 wrote to memory of 1008	3352	msedge.exe	98
PID 3352 wrote to memory of 2856	3352	msedge.exe	99
PID 3352 wrote to memory of 1008	3352	msedge.exe	98
PID 3352 wrote to memory of 2856	3352	msedge.exe	99
PID 3352 wrote to memory of 4924	3352	msedge.exe	102
PID 3352 wrote to memory of 3344	3352	msedge.exe	110
PID 3352 wrote to memory of 4212	3352	msedge.exe	111
PID 3352 wrote to memory of 4844	3352	msedge.exe	112
PID 3352 wrote to memory of 3048	3352	msedge.exe	113
PID 3352 wrote to memory of 3048	3352	msedge.exe	113
PID 3352 wrote to memory of 1432	3352	msedge.exe	115
PID 3352 wrote to memory of 1432	3352	msedge.exe	115
PID 3352 wrote to memory of 2504	3352	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\xui2.0\src\bin\nginx_rtmp\html\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffbbfcdc188,0x7ffbbfcdc194,0x7ffbbfcdc1a0
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,4731147831497224738,5708622628302583194,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,11507795230853423901,6436967948873918143,262144 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,14129337760686682449,30949796693473081,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3360,i,4238906117105108085,13694276603199908236,2097152 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,8598478787063809138,982189507222075999,2097152 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,15529717288552046720,7885932109756856795,2097152 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,3648746315619461258,6100552504934719426,2097152 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13564599936944976490,6839222562774529312,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,9741951298666835862,1396315196223994927,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13483545569155848847,16273249337517913321,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13483545569155848847,16273249337517913321,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,13557644412785085524,4383129772359746079,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8205526425433590876,1208158514164396456,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,13713371783402136546,3900348173568199937,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,5409802213598871394,4417037515274904020,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,14427417406328406857,6336972762601664736,524288 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5676,i,534751198812463528,14827553867845404343,262144 --field-trial-handle=2596,i,13261530113276829081,7369039577589417308,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b62767c74c89907f462c44194371b96a301f66e9589097e49a62385b2606043
MD5 f2dc160d75ccaffd4d18e97b3498ca19
SHA1 bdbd2e36a261ec05e65cecd69d760f4cf2b7696c
SHA512 70aed7ee9cca32767eba9159a57637fcedb01d862b499e92bd8e5252628e341b67b18f9919dece8b44a42b4c27992edaec7b44e7a94440c28595a0387d9b76c1
TLSH
T1C57127340E4900A1FF200A33D4D50239BC72AAEFF61E2E56234D66B5EA0234A139C55B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588855.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588855.TMP
Size 3KB
SHA256 286a3ff0607b0b7e34aad768a6176d4f9a68184c5fb1a95d9be2a33593cd8d9d
MD5 d830dff1f02f60c4d9b8d231f7f56a43
SHA1 77e9c738b20667f9557e3efa85b5b9e5c729d39f
SHA512 938676f4a721324f4bc8f8755a0cf56fd27545edb732629c17c92f0c9613abc15713997fb84ae493d74044857c46d493a160b610031f57bd67632802bb6c7c74
TLSH
T1E27127340E0940A1FF200A33D4D50239BC72AAEFF61E2E56234D66B5FA0334A139C65B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0bf34a12d2179d0a5fadb54d886a582b8145d0abd12fc23523d93898a2b287bc
MD5 b0e01d2a00d356025f03e7d569e6d2d1
SHA1 4f225891ea08f5cf885b6b0cd78bdddc7d28fa50
SHA512 d9c5ab65b63c4a953ab01da4c94bc7c0144c32e37fecd5c3846a7e842e46f01f4378f6d6b568eff187df6506490f8880d3916b8fa65cc2dd992e9e305fa81b3d
TLSH
T15811BDB3C3D585AE890116F05A24AE2BCE2D0516431C3C16C9D4FF27E3E3475D00159B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 19a438c1e371b963e2046f19550efebc8b273305815ed1dfff496e292a14c877
MD5 44cd450d2dba6be3cb1b170ecafae1f8
SHA1 281371db28f95bd3f7ead9bfeffea1813e0b14cd
SHA512 3b9b6e5771e43ad085b44b65c832244b52b16e94fee9d01077c8c37d5b73950cfd4288e5d9fdfce0175ed325b060e8686f801758da8699f3fb46e319bd23e4b1
SSDEEP 192:sxZ8RHyM/jK1Ml8Mkm/fFsFpQOVcIdpdVlHW6+WNGYvraRe9IgrJ:sxZ8tMm/fFsFpQclHbGh69
TLSH
T16142E8126A34A977CCCBD20DFA55BF53D6F5543292901E48A9FCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cdc5c0a7b657cdaa62d914048763233d59e1f699619d2154cb8c52f28ef24569
MD5 22a38b02bb75b851a783e6b7a4a66c7c
SHA1 7ced72ccf057424b4e22dad068bbaa3b8e7d906f
SHA512 4191d2f50e701ae51a40218fd1ef690929ee179db7ce102db60eab62612940ba96a9708de52a8a785748b56f8b65d9b6591d15d9652fcf497b18edb362eb395d
SSDEEP 192:sxZ8RHyM/jK1Ml8UQQkm/fFsWpJOVcIdpHVlHW6+WNGYvGlFe9Ig5KJ:sxZ8tqjm/fFsWpJc3HbGl6I
TLSH
T11352E712AA34A977CCCBE20DFA41BB53D6F5447292501E48A9FCCA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9a0abefe2215ae2e8531773bca500e7ad9f53c02bcb03315fe5d478cb04babea
MD5 31dbe60976aa527f3353c9681fbebc2c
SHA1 5bf5c2802c2faf9d68e3491681ab2a37628eaf41
SHA512 4c274255a8d4151d32770bf7baf3a06a3ea8e3a801347cf71eaf09fc4efc670b4ad9e66bcf603566315d10530410e2893f9f1a9e28d3f28a25fbf88cc47aedcb
SSDEEP 768:64seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppFrojd:64seJ3xWvhfynu1jaVcL88p+x
TLSH
T1AFD20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C02C77EB51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ffec57e25623523f3b55d5f4c9bf96397c557ba32108bf49dcea5146a7f6c167
MD5 a0e27e5998fb9c28f1471cc58d2b2c0e
SHA1 43c8ccaae11d76a78569defe14e32f9ee1d1523e
SHA512 44fb2c048bfd098ced1779dbf4bd2c0f93896ee05070442c3f44e09dbf4724d3283000fbb72d6647250304217b96a9bf522ab6c0795d9565914ee086ad20c7a3
SSDEEP 48:KYHIhKggkXyBAIDK1KcjylDI1KkUILyBeIvKLiw4:KYH+KggmiAgK1KyODKKkU2yesKLi3
TLSH
T161C1B812713F02023C7F355CB2AAA7375E4235A33558A8AF7BB800655E6AE116DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e55cb22e-21a4-40f3-977e-eba2d633451b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e55cb22e-21a4-40f3-977e-eba2d633451b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 200fdc969b939a49db18f10bb720f7299fc70b68b9193347da990c49d3fe6d60
MD5 a5d358949baf1ab25fed3d523f75766a
SHA1 ac99cb79f9da82d7c8d5abc1dd1239fda7ecd3ad
SHA512 a1c5d051c14144c023c40bb703d04a705eff60d972ab5e78468714506ae8b59e9ac4f113c70e2989e2ae0cdea81999e9750b2e8f1a6977ac2ab1b01b50f9f5fe
SSDEEP 192:ulm+xasuheOwQxMGsNa0tQj/IM7CRpQmiU1tCp4MTW0+FdLuhpFd3EZZ8z1crqSH:VZcIhsNaKe/Z7OHa21dyZdUQMZ/9
TLSH
T12D626C725C786C3BA9E6B145F54A36074FF4C037E6C86B50A6ECAF1E01DA6A8031791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9f0ea8e06f6dabe472b59dbc21221288b4e685e2aa8085d872c188f9fc6ace9
MD5 5759ab837d147864753a127ad2ac890e
SHA1 d371cab3bb3bb679a06f1b69bfbf7f75a9ce63ea
SHA512 7c64a2284c3bea915f2c2990911b81ca25d7e4434ae2869b82f21a96ef38ffaa0cb39230e6a627732572a6183eb3b57afcafe4cb36872f18d9db108da238f757
SSDEEP 192:lON06vMtPQmiUyJKThTW0+FdLuc847gbLU/u:lON06UtRfTudy+cLU/u
TLSH
T1CF020835AC786CABAAA3AD45F48A27175FE4517BEAD05B50EEE82F1D00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 34b390887d0abc6d5f2826b4278fd3dd42cda3f6b33b83aba6f95d365ff91754
MD5 3c39f243b6c010cbdb6104f1f434d0b6
SHA1 4f08f901eb9d755876d6f06c76fbd466e2d6f966
SHA512 50de788a7c6843392a782688aed26efb0558f6ecd9de6a9a07973d63ed614dc7bac9cde8dd30ea8036b57fe257319f8203476295260e9bb25fcc11cc0d3724b2
SSDEEP 384:BiFiZcIDsNi8TUNTUlIlXe/Z7OHa21dyZdUYMZ/9:oFQDXwgSZj4kUYMl9
TLSH
T1AF824B735C68A93BAEE6AB45F54A32038FF48077D6C4AA50E7DCAF1D019B1AC0307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e215517c1bc75a2f725ea24d231d9854ee07b61f24a400d9905ef18d9e2547a4
MD5 2f43ac49705ad33e2da4cabb27e400c3
SHA1 781f29ad606f2fac9e757e9e2f6fa037f2d6d219
SHA512 a208f2876f635ed52d187adb48585566c2c62a5ea5f6461bcb15bb6de4da3a6b110a65676690b92f7776ce76b7b788ecdf0d840ea8a2365627e3f9fae3a669ee
SSDEEP 192:uYm+xasuheOwQxMGsNattQj/IM7CRpQmiU1tCp4MTW0+FdLuhpFd3EZZ8z1crqSH:wZcIhsNaXe/Z7OHa21dyZdUQMZ/9
TLSH
T164626C725C786C37A9E6B145F54A36074FF4C037E6C86B50A6ECAF1E01DA6A8031791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2985b8c6a5c4ffa8eb639f1a30fa8c304c036f223227446e27c4f7b7f7e8f356
MD5 c1787b7973ff974d79df95b5a92c5d96
SHA1 eb57b62778beaf05f34db168c841450a9f1971b2
SHA512 fda7e39829ca95487ca83dd934cdfa97c1b586839540e549fab6bcffbb5ac77e65cf5bee8fdd3746cb401bc7d53014d895c0aa32870bc4c8ae92d810bb25d0a5
SSDEEP 192:hON76vMnPQmiUyiKihTW0+FdLuhpFd3EZB80IcrqSU/u:hON76UnRKiudyZdUMMU/u
TLSH
T19D121B75AC68AC2BAE937545F48B36174FB0817BDAC46B50EAEC2F1C01DB6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

344f1fa8-6115-4e97-86ff-128233faf0ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\344f1fa8-6115-4e97-86ff-128233faf0ba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f35d6673586738046ae0b11d6f796751b4945c95fda88c1a79791ecffe22600
MD5 4e6cce8f7107adc4f2b28c314bd962ac
SHA1 60649238ead5492826eba0a97a419e5c077c13c8
SHA512 84099bc423159e5ba03c3b4caf7e5b6cd03c909ef3b530c2a233fb20903b0e21bf82539f8a94f7d9bcc0b2dadf4d746a44c6d73c2910ad7bad80f3b8e4e550fa
TLSH
T13B410458A6EA1148B3B76F5AAFF2A86D587AB9732F07D55D00010D4F4B67B00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download