099297421ed292111003948ab788b95959dc327f3c4ece4262fae21340064ed1

Analysis

max time kernel
148s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区_最新网址.html
Size 1.3MB
Sample260723-prd25ayfpd
SHA256 099297421ed292111003948ab788b95959dc327f3c4ece4262fae21340064ed1
MD5 191ed2f790ed01bd8f81e8fae3aa495f
SHA1 1e1bcdf57e82d2bb4cbf1dd3e1b666b1aec2cdaf
SHA512 5e7aed8ec76d17a5d895f695a1dac4e3104ad58b436474ff7f331c2473e4945beca30376c7d861eea908a3503e6590f68f419404086ac4a95d7eed765523e7e6
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++p:EaK2IuyTFCseZ13FSr++Y8xU/oT
TLSH
T18C550055D51A00A275CE056A3EAEF25E227C3A1B9FCD974D0D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4452	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292837020441384"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{32FA2F85-76D1-4F81-AE08-81CDDC19130E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4752	3796	msedge.exe	87
PID 3796 wrote to memory of 4948	3796	msedge.exe	89
PID 3796 wrote to memory of 4452	3796	msedge.exe	88
PID 3796 wrote to memory of 4948	3796	msedge.exe	89
PID 3796 wrote to memory of 4948	3796	msedge.exe	89
PID 3796 wrote to memory of 3156	3796	msedge.exe	90
PID 3796 wrote to memory of 3156	3796	msedge.exe	90
PID 3796 wrote to memory of 3656	3796	msedge.exe	91
PID 3796 wrote to memory of 3656	3796	msedge.exe	91
PID 3796 wrote to memory of 3656	3796	msedge.exe	91
PID 3796 wrote to memory of 1932	3796	msedge.exe	92
PID 3796 wrote to memory of 1932	3796	msedge.exe	92
PID 3796 wrote to memory of 1932	3796	msedge.exe	92
PID 3796 wrote to memory of 704	3796	msedge.exe	95
PID 3796 wrote to memory of 704	3796	msedge.exe	95
PID 3796 wrote to memory of 704	3796	msedge.exe	95
PID 3796 wrote to memory of 620	3796	msedge.exe	94
PID 3796 wrote to memory of 620	3796	msedge.exe	94
PID 3796 wrote to memory of 620	3796	msedge.exe	94
PID 3796 wrote to memory of 3472	3796	msedge.exe	98
PID 3796 wrote to memory of 3472	3796	msedge.exe	98
PID 3796 wrote to memory of 3472	3796	msedge.exe	98
PID 3796 wrote to memory of 4464	3796	msedge.exe	99
PID 3796 wrote to memory of 3628	3796	msedge.exe	100
PID 3796 wrote to memory of 4464	3796	msedge.exe	99
PID 3796 wrote to memory of 3628	3796	msedge.exe	100
PID 3796 wrote to memory of 5068	3796	msedge.exe	101
PID 3796 wrote to memory of 5068	3796	msedge.exe	101
PID 3796 wrote to memory of 5068	3796	msedge.exe	101
PID 3796 wrote to memory of 1208	3796	msedge.exe	103
PID 3796 wrote to memory of 3848	3796	msedge.exe	115
PID 3796 wrote to memory of 3928	3796	msedge.exe	116
PID 3796 wrote to memory of 4700	3796	msedge.exe	117
PID 3796 wrote to memory of 704	3796	msedge.exe	118
PID 3796 wrote to memory of 704	3796	msedge.exe	118
PID 3796 wrote to memory of 3692	3796	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区_最新网址.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb8325c188,0x7ffb8325c194,0x7ffb8325c1a0
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,876916108936292400,16177480167186498293,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,15323352212510519767,1516035977462160735,262144 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,12678108063815154914,654208967897923961,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,14501957652274736044,11556014989404296981,2097152 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,1271854922192928184,11138201908539411707,2097152 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,2429195951560083010,3483381789243768117,2097152 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,10448636094810831817,10098652362566757055,2097152 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5128,i,6468429433847204191,8276675490273321738,2097152 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,6899331945886602080,7084441079325996243,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,9704802593589445317,13097474531932665699,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5264,i,10230939488248477590,545679507455089992,2097152 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,2264935544199849242,12572445777376164196,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,2264935544199849242,12572445777376164196,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,11454594312262701706,6389608385374481743,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,11673864235848081090,13885539883126362304,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,5215889961340287287,2668177218114135977,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,8711607541509612034,11262581583979869175,524288 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,2510022914031853948,9310100619275564393,262144 --field-trial-handle=3020,i,4719168989086203931,4751911500648210312,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43b0f30e-fe71-448b-ae03-adef42bc5560.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\43b0f30e-fe71-448b-ae03-adef42bc5560.tmp
Size 8KB
SHA256 052bccbf5a8b58919dbafc1adfd8baeda49e0ee9432152832a5930a3896ca053
MD5 c89495ace53349d376a4cdca3086b799
SHA1 5be61dcda3750589952179bac69eff1854c8df5d
SHA512 3a535287af8943a2b1043a8c69d595b1ef46f3508a4bf32e2cacec0f23e0ee5371e06b41f18aae413966781ad16dbde19f4ebad52ad5a672233f8b7343eda840
SSDEEP 192:lONl6vMtPQmiUyP8ThTp8CfKBp847vrU/u:lONl6UtRTTHfK3zU/u
TLSH
T1A502F876BC786C7B9AA7AE45F48E27171FE461ABE5D05B40EAE82F1C00D765C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88ddbda137345241ba3431efccdf2374c15d42be59fe8c628689a5543a3298ec
MD5 2909dbab61ca2021ce35a9ccaf5d5bf4
SHA1 4d046492f773479f1d7f2826640f9c381a1af243
SHA512 f0d3e27f363f12d49c3e8dc619f71e953ab8a3777996f491d9c3f6b6c135c3c35030fb3b065e6163cf96ef0b95ea24b6fa4863030adc8c4e98463ede9cbf3cbc
TLSH
T17E71D676C003C8F0EFF740B194969272707157E4FE82CE8A6D8F9AB5562C6EA8ED5008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6e95212f440abf12a3390c96708772c3c52a960c1afd728b1eb742dafb031204
MD5 0530201e18e2bc3d8e74dcdfa9ca7d95
SHA1 6ad9bf230a6a1835d3ed848517b9e3efa920ec15
SHA512 ed54cdd28d14b65e839e2496896c2292bd348c87625fed3f3f71cbfe5068b6778c304b23f2c583433d3884d27ae9a4eb3a1fd2fccc8f4eeb5a0e9a10a88aaa56
TLSH
T181418DB7C3D5866DC91516F0AF147E2BCE1D0A5843283C2A89E5FF1BA7E2471E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8aef1afb779c1c9558dc1efb1e63f18dbace4636ac739a358a7163a9bc65c560
MD5 d0bd7d0c295bed1fce23a89e07dc97f0
SHA1 d092fd48743cd539f8d9e82f43219ace82b2d661
SHA512 b5c26a5b7163fa3e9c6d4244676e3029fb7e4f88185ba510d0b7bd413186b52ff42d48f76d09b13bdaaa9f69f05ffe4b63c06aed6b780670e8d3a5b98bbcdf5b
SSDEEP 192:sxZhR9yM/jK1Ml8Mkf/fPslWuVJIdpdmkYHW6+WNGYvrBAX8IgrJ:sxZhzMf/fPslWHeHbGTQ9
TLSH
T16252D7166A349977CCCBD20DFA55BF53D6F51562E2900E84A9FCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a04b81f9701235d5425c81ae28553366704462644386c0a14943bbf345eff56b
MD5 c75f96dd14b7895abe548002ebac7800
SHA1 9fadc9bef905779f7d9247e1c35165d5d54d34bf
SHA512 ecae6fa62a53a0b61c310dd1aea5dead0a7cec03125c808ed9c165e5edac4b39c2a83f5dcc87fe74f0af53566e5be9b273bb069d059cb643273609f3382208de
SSDEEP 192:sxZhR9yM/jK1Ml8UQSkf/fPsdYuVJIdpHmkYHW6+WNGYvWQuX8Ig5FJ:sxZhzqRf/fPsdYHIHbGvQV
TLSH
T1B552C6166A349977CCDBD20DBA55BF53D6F61472E2900E84A9FCCA0C04E6BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c40e7de3d299b5987d3498f942b368d2a46aa83ad8022cfdd6075ae290b4c764
MD5 6b44566bbdd4c1bbb5b264abfdd6287b
SHA1 1c3cc6820af3e10b62b70bab285847b673068157
SHA512 eb69ffe25b0f1a6c6c9d4bcfef05f0079a99a4356a52940ccdb2dd9e3c7703152912dd55556a5d5d63d0151fce13efcee61330210be845e3e7c3bdb623db2d5d
SSDEEP 768:B1seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppWromt:B1seJ3xWvhfynu1jaVcL88ptI
TLSH
T131D2FB2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1194c1579aa46e5f8099a12c247f396a99fc2ec1b71f06a2575a7a76646483bb
MD5 814c587588ac71741f3cc4865dccbcb5
SHA1 f759d88cc4e8ef126d985353e1075f867e9ed892
SHA512 71f3ce6a1e9470f0dd7a6c1b981cdb31956402532f49e5b491600f37398ca8ba91967c45d1bd78857bcd04880eb72629157be478785f5552cc1c8d81b902501a
SSDEEP 96:KYH+KggmehuKqcCuTaKcczdEdTdWdCdEdmdK:49pNBwdEdTdWdCdEdmdK
TLSH
T175918816717F0302387E2458B2A6D5374E42379374A8A9AF7B7800A68E27E531DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

471b4c4c-cee5-4f50-b193-ecc81290222a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\471b4c4c-cee5-4f50-b193-ecc81290222a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9e0731057b225ec216682122c9511ad9f2ac070e3f428cda4c99e036551755b5
MD5 1ce6a6f763cfc40443ccca2b7b41608e
SHA1 5c27f3be2f814f2bcf78fefba89eae6bbe3e5fb0
SHA512 f827bec8b4acc408977ce70a845216d808ad8073f983f6e8e14153d68c33fbd83d682a09bd4a64f6a0761c1e9b4b75ef1d95c4581bb726be0faf2577e7d28518
SSDEEP 192:8ON26vMRPQmiUyV8UhTp8CfKBY6Fd3EO80IHqMU/u:8ON26URRDUHfKhdUHHU/u
TLSH
T186120AB2BC685C6BAD97B585F48E32131EB1916BEAC46B40E9DC3F1C01EB65C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 603480b720d1da10fd4b8b3456232d0d7867be57ea58e6c31e7cd1ddb73865b6
MD5 e4dceaf12273c20c6b8dd2147bc7eea9
SHA1 3615e92faf6eaee096af4a690e32f25164c0079d
SHA512 382e79d2276914b041c1b43d5e10a0b75285f16d8223525d2139afa1f54f522d33fb372d1836d1143373f5344b33eceaf1d896965aa9065e548ca0e446f4dacb
SSDEEP 192:uhm+xasuheOwQxMGsNjVQTnby/9M7mz3QmiU16Ar4MTp8CfKBY6Fd3Ef8z1HqMq6:XZcIhsNjVene/+70ZN0AfKhdUkHq6
TLSH
T191625CB2AC745C3BA9E7B149F58D36031FF59067E7C45B80E5EC6B1D00E66A8030B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c8288756095ac7b4c0349ad97caee647697c66988bdbf525cec08fb377d1ce3b
MD5 ebac6a4ed24ae871f25c060d54e2f032
SHA1 5fff779bb1933327895df2f38ef65f759924ed28
SHA512 c6ab4ebfef6df79fb8ac76052108e62cba26ff84a70d5c9e1f175474dceebe9bc1a3374f868df9585a3affb36a47570e936d5c40a44844d7d090769c03b042d3
SSDEEP 192:u4m+xasuheOwQxMGsNjkQTnby/9M7mz3QmiU16Ar4MTp8CfKBY6Fd3Ef8z1HqMq6:yZcIhsNjkene/+70ZN0AfKhdUkHq6
TLSH
T1AC625CB2AC745C7AA9E7B145F58D36031FF58167E7C45B80E5EC7B1D00D66A8030B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 7f3b35540b3a5e6802efdf9fb1b3a0dc3e8d3b75c26436143e66db6e7a9d78a5
MD5 3538c66ac2e572d3fa82f040d290dde2
SHA1 00385c2382bbbaee15472d408e315386a0bf14c6
SHA512 43d83285a61ca3bb50329c13e2f82e890433c204f71f1f6815fa65854c645f5b47490a7d9a57fd02bafe5ab751fb29d6f8fea3f253c7ad068bd8fdc6758a18b3
SSDEEP 384:xiFiZcI+zsN98TUNTUlIlVene/+70Zq0AfKhdUKHq6:YFQeswgGe23DQUKHq6
TLSH
T10EB2F8F258D7883AD9AEA747B77D2E034EBDC067B5849640B7D85A0CCC961BFC306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ad59bcd-91f7-412b-98fc-27daeadb5047.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0ad59bcd-91f7-412b-98fc-27daeadb5047.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5dbcd325de73496bb4b7a7aa1f87c8df752b5dfb60eb315a52736ea7a69d7880
MD5 fdd8d2f656d42bdea837d590634fc0f5
SHA1 dd75e966c6a2c633be5183f1528c0fcb08c048ba
SHA512 c1a915a09830e79ac4ddddf01bfc94a915c2099086484f99b82903e9b5c96d8e4676310f3023f96895ea18b0d4dde93f9a741c528fdf46d0ebdb5d4702441718
TLSH
T1D9410B58B6FA1108B3B76F56ABF2786E447ABD772E0A945E10010E4F0A22B41C972737
MD5 SHA1 SHA512 TLSH

Submit Download