a1128566790d58be30d058caec354ae2dd1653c3ad836c3370e97857560fd9ae

Analysis

max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20251215-en
resource tags

arch:x64arch:x86image:win11-20251215-enlocale:en-usos:windows11-21h2-x64system
submitted
16/12/2025, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区_最新网址.html
Size 1.3MB
Sample251216-phk43syrdm
SHA256 099297421ed292111003948ab788b95959dc327f3c4ece4262fae21340064ed1
MD5 191ed2f790ed01bd8f81e8fae3aa495f
SHA1 1e1bcdf57e82d2bb4cbf1dd3e1b666b1aec2cdaf
SHA512 5e7aed8ec76d17a5d895f695a1dac4e3104ad58b436474ff7f331c2473e4945beca30376c7d861eea908a3503e6590f68f419404086ac4a95d7eed765523e7e6
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++p:EaK2IuyTFCseZ13FSr++Y8xU/oT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5780	msedge.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1244719711\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1537428709\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1537428709\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1244719711\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1244719711\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1537428709\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\ranked_dicts	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1178991009-2361302031-1021871258-1000\{C59A6CB1-F32D-4F8F-8C05-F201A81B817B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 6088	5780	msedge.exe	77
PID 5780 wrote to memory of 4996	5780	msedge.exe	78
PID 5780 wrote to memory of 5384	5780	msedge.exe	79
PID 5780 wrote to memory of 5384	5780	msedge.exe	79
PID 5780 wrote to memory of 5384	5780	msedge.exe	79
PID 5780 wrote to memory of 5108	5780	msedge.exe	80
PID 5780 wrote to memory of 5108	5780	msedge.exe	80
PID 5780 wrote to memory of 4236	5780	msedge.exe	82
PID 5780 wrote to memory of 5028	5780	msedge.exe	83
PID 5780 wrote to memory of 4236	5780	msedge.exe	82
PID 5780 wrote to memory of 4236	5780	msedge.exe	82
PID 5780 wrote to memory of 5028	5780	msedge.exe	83
PID 5780 wrote to memory of 5028	5780	msedge.exe	83
PID 5780 wrote to memory of 3084	5780	msedge.exe	84
PID 5780 wrote to memory of 3084	5780	msedge.exe	84
PID 5780 wrote to memory of 3084	5780	msedge.exe	84
PID 5780 wrote to memory of 2020	5780	msedge.exe	85
PID 5780 wrote to memory of 2020	5780	msedge.exe	85
PID 5780 wrote to memory of 2020	5780	msedge.exe	85
PID 5780 wrote to memory of 5000	5780	msedge.exe	86
PID 5780 wrote to memory of 5000	5780	msedge.exe	86
PID 5780 wrote to memory of 4388	5780	msedge.exe	87
PID 5780 wrote to memory of 4388	5780	msedge.exe	87
PID 5780 wrote to memory of 5716	5780	msedge.exe	88
PID 5780 wrote to memory of 5716	5780	msedge.exe	88
PID 5780 wrote to memory of 1412	5780	msedge.exe	89
PID 5780 wrote to memory of 5596	5780	msedge.exe	91
PID 1412 wrote to memory of 1268	1412	msedge.exe	92
PID 5780 wrote to memory of 5540	5780	msedge.exe	95
PID 5780 wrote to memory of 1260	5780	msedge.exe	96
PID 5780 wrote to memory of 2976	5780	msedge.exe	97
PID 5780 wrote to memory of 964	5780	msedge.exe	98
PID 5780 wrote to memory of 964	5780	msedge.exe	98
PID 5780 wrote to memory of 3232	5780	msedge.exe	101
PID 5780 wrote to memory of 3232	5780	msedge.exe	101
PID 5780 wrote to memory of 2380	5780	msedge.exe	102
PID 5780 wrote to memory of 2380	5780	msedge.exe	102
PID 5780 wrote to memory of 1168	5780	msedge.exe	103
PID 5780 wrote to memory of 5488	5780	msedge.exe	104
PID 5780 wrote to memory of 5488	5780	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区_最新网址.html
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffa781bf208,0x7ffa781bf214,0x7ffa781bf220
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2068,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1952,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2296,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3536,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4868,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4864,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3856,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=3860,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5552,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5760,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5776,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5776,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5864,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5680,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5704,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5212,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5960,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5196,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5884,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6156,i,2523685466738936175,14962670892128274734,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d1ab0b2228fd89a1d62b2cbfdeae44ac26a1c710044dfc70ffb6c36c6d7367f
MD5 0237910241575264fa80a16e9de2b93b
SHA1 9b2024d332fafda3ba52279e32590e5e56ee9037
SHA512 e4094f0cc38f7162f19af4ce92cb9d9a07cc50fc2ebf4dff7e622a4f32b6476366f93ab7a4056c42b236c00933e6430410aa62419ff8820f10d4ebd25219da4c
MD5 SHA1 SHA512

Submit Download

313dd2e5-d619-4c2f-bd5d-19a78901b330.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\313dd2e5-d619-4c2f-bd5d-19a78901b330.tmp
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5a74a593441bef3ff67232e2781801552fc43e461dfd06c01ac4367f8e0272b4
MD5 ee9ebd3dfa6a6be8724d057bfad684ca
SHA1 4faf78fde96305da285828b346acc69589cea3fa
SHA512 c12aa70884c69845d01ab5b9ef991cb789d944ab668e50e3baa08586aae08267e3f93eb8b5472379e3606bccd8410780eb0a68da6aab70854beb3156340cfcfd
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57e87b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e87b.TMP
Size 3KB
SHA256 34d11e1a09eebad1298a24332de232304d1cac9e0abdf8f6b879148df45ecf3a
MD5 9d745cf1bc9a0ee1d79b509afa9f626f
SHA1 909fa0f67c24fd728e1558714d6c5df493513bbb
SHA512 3a1dfc8be0d4b614a54f46ce2c76ad8dc076e667d3de83f6bf881df3d56158c1971844f11326790dd78f71e5e171634010d6928622043ffe328f85cd2972b323
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4fc79d1c051d4725771120cddc12dc1fd8797ecc4786fe6fa1f114837a530aef
MD5 55df101110602b5899c843b7b2a45256
SHA1 91ffd1f5baa4dc2230766ed0ec127dba0075c151
SHA512 5c18982f0f2aca239b27d95ba1dfb8fd453debf6163eae1f5e20275511913592696c88380716385fc8ec5ec0565272801cb3670c065a83a25b85d573afbde54d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 804a0760e1ae46ffb6e10bec82b3bd93efb83aa6df9e5a9f25d5337290286e76
MD5 f2664e661ea062995741aa3f9c460685
SHA1 fc87aabd18b07e7e339ec3ba0fea42aa091bdd48
SHA512 3fa0dedeb51bba799c8e48b5817e4501e56fb0a29dff85c3fc0a258c7dec2c2f69648449733c44af6784a6b4c6299a3fc35f0d3dc4e60f12c175e47dc9fb7e15
SSDEEP 192:sVdR+yMqvOK1Ml8M3PlscjvmvnnmX+yo/zoZ8pY72o/Y+WNrY0+QqE12uIgxJ:sVdAPPlscjmPmX+zno/Sr5aEcG7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 44e15867c730f852e76aa42af098d67e58669bc36b305ae9f8397d7b224e909f
MD5 ee851a6f174f56d179e0f035802cd92e
SHA1 6cd0becbb4886b2f54c770826a9dbdf4fc2d5d1b
SHA512 352580081d466c812089ddd04aa439e4e40086ce5a955a33096ff58f2a8b979c02d17632307400b9346eaf3a75a36369ec792e8894257b1593a2b2b767b6c606
SSDEEP 192:sVdR+yMqvOK1Ml8UQT3PlscjvmvnnmX+yo/zoZ8pY72o/Y+WNrY0+lqE12uIgC7J:sVdAqzPlscjmPmX+zno/Sr5XEcGC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ebbbb0abd2eed61d686a3ee827ec1fd8b1ec44620cf2c9f918e6a4aec9a2d391
MD5 e3c8f14682f8b27242e092d305305c7b
SHA1 5e1d634f2db9148459bc3d730026f09b4865f8dd
SHA512 03a210f97553290e6e7caafc3e950b337b3110c222b96fb3f3f63c0488a6278d1a1c0b3417ed072938cac73b6c20c9e78ed0cddd51164eaea0409a92528554bc
SSDEEP 768:Z690L8aj2Ru7pLuLDAeWRW6SQuq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3sEKJLlC:Z690L8aj2RuEDAeWRW6SQuqu1jaKsEKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 75275d734cbc19696a6b7c16e8a4b1897dabc04f8649725ec05db0cffc5e9ecb
MD5 cb8ce9513e0d008bcb6a52aab0768be0
SHA1 bbdefb48ace20d98ca1e2c5312090bfff9e03021
SHA512 af246c8f0c5a560f184ee52c223a2aefadf078a2b27830c51f6176e2af898d4ccbf3e5246646f2915c32012f958c482a0673fdce9307e7eb8dd4d06300808836
SSDEEP 384:uqjuqMUkp0dKq6AgKVw1KoPMVxPFlwRi15bhPfq5Er:5
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 466B
SHA256 e9d41e971cfb1207f15a98d483d534281f3ef29749b8fec5cbc2a17489dd2a80
MD5 3647d861d06d8a8601c6d01ce2db0c60
SHA1 c59e6bf05cc964be667518f3c0d0315b783f002c
SHA512 75a27fc5ac75b6889a5370a017403237773505073fd7bbf89941bd19435749f34dd9659ba9c4ba094f4c1e4c522c665ff8472c3e840cab5d08244f2bfac69da5
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1fc9534f8f2a4156a7bbe0235d7455bae4b8b21823629e91b2033f827ab157d2
MD5 6c9be13040b412911a5e6555e72ad20b
SHA1 04255d74f4762365d2c19d6cd6286a14fc9c557a
SHA512 c0c757cd8990ce972f4553afd6e4044aa19ba88717061fd9e86d7960b274d34c75091ebc8ee5f8a45f0c4828f80fe17a249283a9c800cd1bf4622f1d5a33fef1
SSDEEP 768:dF+YfJSJLdOuDwLAs/Cg32NF+6pzS6X+AgdTFR33XHb6:aYfEhOuID2NkRAev33XHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6f17e7fa2ad1fd5b76442304676f5fa39419ee24d4566eb00a6155daa35105e0
MD5 735bc2cffe491a19e6e61743b7b4e66e
SHA1 3b24cf8aeef7272c365b9a12d4f60b31a46f1ea9
SHA512 c3064d6ed3dbddd65f0322306e3387a01ef5fe1fe8a44928bf56f0a97cd46a87492cabdf25976ce12cfa478a770214000e58bdfb7077dd39f91be9324ca84cf0
SSDEEP 768:eF+YfJSJLdOuDwLA//Cg32N9pzS6X+AgdTHR33XHb6:XYfEhOurD2NORAex33XHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 9ce5c7eea79235e4c64e1069f9577f9befbf96b2c58b8d59070b22ec5dc79e91
MD5 3bd8d720da8a18b3e6d4c5cde6cabf17
SHA1 70fcdfac40e9598382ac888c52640ce971e497ca
SHA512 56114cbd003e7efff95cffb9a5667228c06a2439c293fa0bf7b438c61f37b390c2b52b8798c609b1d469a3b6bcd520b1b475999b72b62d0fe90bd5b21a06ed5d
SSDEEP 768:OFqYfJSJLdOuDwLA23UCgS2m38zS6X+AizNHx:FYfEhOuy3R2mBRAMNHx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7ffd4d3ad86627da6e6d4ab494a5d0779aacb1acce8e17df8ca2a51017a8d2a7
MD5 7b5cf48c4dd75378d4ff5def19bd1aa6
SHA1 c7d77b967ed0a0fab0cfb95bfe450b96de89ce53
SHA512 4823e5219755181fe7c78d86f1603fcbc86901e5c4db6f2446e8944e79c8d443e08958ec235590e51051da16a8dccd99b3bd5f21f9345540014990c675340f66
SSDEEP 768:eFqYfJSJLdOuDwLAf/Cg32G9pzS6X+AgdTHR33XHb6:VYfEhOu7D2GORAex33XHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.12.16.3\typosquatting_list.pb
Size 1.4MB
SHA256 0e550277e89fc54660760c5a5e11bb6a1ed47d5c5626612cb3ccd5229262fe5e
MD5 0521c6c92b4e90121320556a6c35316d
SHA1 418d5c61d3bddefe0fc2b9bfb2b2ed08a3dd57e4
SHA512 87d45db7dffe75e134c1ed5ee2bca521bf219b9d2b95a4a15da31abef053ce5b8ed12fae4dc4fd494e1ca21a112319be77b71d20acf81d7ee12265c2ee6e0e76
SSDEEP 12288:VtzI2RFrYckx2GI0K+kZWWmSLwjY0NtIFsIzvNUS2v:5n/kx2GIrZWWmKRPFsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_11263033\manifest.json
Size 69B
SHA256 dc6a19395ad3a24ee3805f6e90c6b16fdc141a51ac7fbb99fb784e423f8962f3
MD5 b721bdf2924d658186ac8868dbd2c008
SHA1 914aacc65bb7933bd73aa06f8bd2ca0b04de3858
SHA512 4c1c16f714a2e2436697bc801f7e2f684010c833e3d5fe6ed68d6f3e630afa495412ea5a1b46f4bbbb1102feede84e72f32686910492510cbce71888a85b5fda
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1244719711\manifest.fingerprint
Size 66B
SHA256 33f077f5694ef3fdec3a0873c54e32146372edad1ad96541793e628563506ef5
MD5 511dfef86757a5509fecba95c32ca908
SHA1 8394a5fdccf895f79272a84f8f53e03279a98d05
SHA512 e8c75f28c3e691e9d9c76ca209a46f06655e3f59eb20f951f62c429704ed6acb5846e8db21afb25ec94d83fcc75ede2ca331140688708fb04222b7c82c78fd5c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1244719711\manifest.json
Size 119B
SHA256 f34ee36a4fca8b0c74dd13f32aa0836196dde0d0af3f5cdff0076b86b9c1a98f
MD5 573fc3ed173e665c784d8e6786a7f8b7
SHA1 fe9d78f6197cf9cacf1be41667d8d6ae26e37217
SHA512 b2b3cc7331e1ecb29f37457d7f8b302b2ac1b575fa87f8a2ad2c837ecab338b8d7babb9a6c9499b70b9edbe08a400d87b738db891739ffee3592b6839f0ad250
MD5 SHA1 SHA512

Submit Download