8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/__扫码.浏览&下载 _1024社区.html
Size 1.3MB
Sample260723-prd25ayfpd
SHA256 8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333
MD5 15280afe83c4f878e148e21115befc55
SHA1 0b14258bda8d938b9912fadab12603b001ce801b
SHA512 1706e300c677e64e4c79936184c4f95a0e4d35222e197a119ff653b61f72716a91b15fb9c43e7ba02adfcba1e33f40d27285875e003f03279cda0be21a1fcf9a
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++J:EahIuyTFCseZ13FSr++YGqL/IT
TLSH
T14F550055D51A00A275CE056A3EEEE25E227C3A1B9FCD974D4D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292836843644429"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{C2576BCF-71AD-4888-A723-1DBE978F4ADC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 4184	5996	msedge.exe	89
PID 5996 wrote to memory of 2704	5996	msedge.exe	90
PID 5996 wrote to memory of 5080	5996	msedge.exe	91
PID 5996 wrote to memory of 5080	5996	msedge.exe	91
PID 5996 wrote to memory of 5080	5996	msedge.exe	91
PID 5996 wrote to memory of 5680	5996	msedge.exe	92
PID 5996 wrote to memory of 5680	5996	msedge.exe	92
PID 5996 wrote to memory of 4220	5996	msedge.exe	94
PID 5996 wrote to memory of 5536	5996	msedge.exe	95
PID 5996 wrote to memory of 4220	5996	msedge.exe	94
PID 5996 wrote to memory of 4220	5996	msedge.exe	94
PID 5996 wrote to memory of 5536	5996	msedge.exe	95
PID 5996 wrote to memory of 5536	5996	msedge.exe	95
PID 5996 wrote to memory of 4248	5996	msedge.exe	96
PID 5996 wrote to memory of 4248	5996	msedge.exe	96
PID 5996 wrote to memory of 4248	5996	msedge.exe	96
PID 5996 wrote to memory of 2284	5996	msedge.exe	97
PID 5996 wrote to memory of 2284	5996	msedge.exe	97
PID 5996 wrote to memory of 2284	5996	msedge.exe	97
PID 5996 wrote to memory of 5096	5996	msedge.exe	99
PID 5996 wrote to memory of 5096	5996	msedge.exe	99
PID 5996 wrote to memory of 5096	5996	msedge.exe	99
PID 5996 wrote to memory of 5916	5996	msedge.exe	100
PID 5996 wrote to memory of 1596	5996	msedge.exe	101
PID 5996 wrote to memory of 5916	5996	msedge.exe	100
PID 5996 wrote to memory of 1596	5996	msedge.exe	101
PID 5996 wrote to memory of 4972	5996	msedge.exe	103
PID 5996 wrote to memory of 4464	5996	msedge.exe	104
PID 5996 wrote to memory of 4464	5996	msedge.exe	104
PID 5996 wrote to memory of 4464	5996	msedge.exe	104
PID 5996 wrote to memory of 3896	5996	msedge.exe	108
PID 5996 wrote to memory of 1844	5996	msedge.exe	109
PID 5996 wrote to memory of 4688	5996	msedge.exe	110
PID 5996 wrote to memory of 3676	5996	msedge.exe	111
PID 5996 wrote to memory of 3676	5996	msedge.exe	111
PID 5996 wrote to memory of 2608	5996	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\__扫码.浏览&下载 _1024社区.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,4759947801024513005,14474894616984804510,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,17356770097350469342,9904697551805799762,262144 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,14671793409909167410,6453478917806726058,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,4952125971866169319,11975908357379229973,2097152 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,2816962579202729607,1640683568981398093,2097152 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,15098212224488241052,17596911378937300099,2097152 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,11036968757482738420,6910563747015262891,2097152 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:9
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5316,i,1225715020278742836,16133992215935062535,2097152 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,14925646233195069556,4438367029986247440,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,11834725857933813987,12493679711236274419,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,182828851581906293,4847453934838821984,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,182828851581906293,4847453934838821984,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6312,i,13715207923076147645,5377085167451453648,2097152 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,5175227374226576437,14147867097721391315,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,8012893931952181224,11019683501491348048,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,15320765492613294872,17532238739534534692,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,14627747702769575260,8127762039690901266,524288 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,15086414959226631276,628050414124591504,262144 --field-trial-handle=2460,i,16823324997898122072,16281480570434539334,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b569abebbaaf26f699fc69b66ce0f336d08065af2ccdaaca5421accc53b1c38
MD5 15b32961d6a7ecf7cfd3ed499d358e3e
SHA1 589fb245bb41b29e13242bd8947dc01c5b630829
SHA512 3a094a8184c961e25b25654d47755c2deb772e3e1b40c8e2d156493c5e3abf0dc6eed344ee5135af14f7c22f3d3e81b8799bc96aef8baa0b1a851cef7f08b753
TLSH
T183D09734A536AA91E01A813504A0360021260133359BAB8321A0840C89B000092F6DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b3d4aafdca6d53e8925c3f7eb884cc4df53c5040e755f43d11008640c848633c
MD5 6f42a5bc779e5308faf91a69017a48ab
SHA1 776d36ecc824016bb20d0e7830354857da464f0c
SHA512 1ab83f583e5f4f3c82fb6f5c77ff41dd3dd42bdbfd7500805e179cd663d34686ff8af138b1875557c17ff44075af4d4098f3a7fba5df62a56c3f1a399c08bcea
TLSH
T1BC518DB807B129F2CBA447765AD1E20A32F8889901B3DE5B40401DB55B07F6D1BD2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cc01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cc01.TMP
Size 2KB
SHA256 3c96872652e31be1d56e362e4e36d91d75708281c69a43b7d69eb4422f4f9e1f
MD5 24081ba8082a5719de72eb1c0470bc6a
SHA1 f35754f59ddd6ebeff7d6f114bcb67d7bccef7fa
SHA512 1163af6b1a98c2d6614d5ebdfafc283c02de44ba96624f13d7e1f0d3456f8a9981994cd9642bac6c7ce6e8f39be97473dba751da16cb0f194af13e719872e4fb
TLSH
T1D051A0B807B129F2CBA446765AD1E60A32F8889900B7DE5B40401DF55F07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6425cac8fa2ba2d786607012eb8a1080ff15c988edca941a9a324fccd96c52ec
MD5 761e0b50ac178ae4c08fda0eb98a9acb
SHA1 23a83ade55f2e2664f1a5245b764badeb07e698a
SHA512 6ea82f4aa75171a6d4ebd4e7aaff7bf70c2b1a6005a6cc4ffbca98e402b8a5d3a716ebc38ca55adeea5cdaa8c892b3a7e146a3f4acf603ccfde257a1c7e3bd1e
TLSH
T1C451DEF3C3E8853D890156F4AB186F2BCE1D0955836C3C1AC9E4AF1BA7E2871E24194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a9a8b934f51d5caa0e89cd647961e81323c4ea3a10fcaa545c67d278a8a75117
MD5 c733888488bf22c9ed89646ec1ba1f49
SHA1 9e6a2b3e39d50fc4a968a4dd87bb1c4293c7da27
SHA512 2bc46fdb47080b988448ef039ecebfe62447283f753a9a1bc340cdb03f3ce822ade87c12c6a62797610a6c809d68d52f070edf91e367ed478c74c1b56c6df8d9
SSDEEP 192:sxR1RCbO6/fOs4tDde5lSWzoD8p43T/g6+WNIYCauOgGEIgDyJ:sxR1qn/fOs4tc5lBK/5Igca
TLSH
T1D542C6566D28A93B8CCBE21DBB55BF53E2F95032A1901E48A7FC870C04E67DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 12059a6a2f3d440442dc670294c0206b63907a873a84d797716502ad331757da
MD5 905ee552289bd7059b749e295ce68ea7
SHA1 11b3d28aeda7ad42fed3e6527b93d960b68924b5
SHA512 d9d0cd3dc2cb933f9016ad522d798bf6368cfc3f4a64461935c4f05e2cf6401940a6e472d84404cb2546b5115bd4501d97e071f490fb24241241d7c89b0aa1f9
SSDEEP 192:sxR1RCbO6/fOs42Dde5lSWzoD8p43T/g6+WNIYCyuOgGEIgDQJ:sxR1qn/fOs42c5lBK/5IQcQ
TLSH
T10242C6166E28A93B8CCBD21DBB55BF53D6F95032A1941E48A7FC860C04EA7DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e56f4298a57acfe88c94c329504b862b777cb91f92c925bc35ba9c2f0e9e0af8
MD5 aec7851da137fcf51bbe169c8150b88b
SHA1 45c412283476d978daf0b72638a51188f81efc11
SHA512 f5c44f535f1a2dd0e38382f321ac5251712907d628b9d6c309dc912f8575a73f09bd65679b913c81aa325c36b581fce75be128fbc4ec5c2b0a4cf9b68ed7c33b
SSDEEP 192:sxReRCbO6/fOsf2Dde5lSWzoD8p43T/g6+WNIYCyuOgGEIgIJ:sxReqn/fOsf2c5lBK/5IQcs
TLSH
T1A732B7566E28A93B8CCBE21DBB55BF53D6F95032A1D41E48B7FC860C04EA7DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b63d7347160c837709a3acb6ae6f66c094f7f3bec2572fd980c8515918022529
MD5 af13a419549fba8234be60e0ef8590b2
SHA1 a70eaa3759c67832f0358b7141172e5ff57cf809
SHA512 3fd62ff8b576db7af8804f35908270e3dad75196476e4ac63b2c99d7712d97fb25316478e4199a4db40b781f0967da4165033cae310b5e7d1dcb9b34c7d3ec36
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvmroZSD:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vf
TLSH
T1D8B2EA2B600DCB7F4F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a71c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a71c6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9f5b167cff32aeba17b375bc11632cc011adb74cb1daff39241cefd353e25dc5
MD5 dd00eb3a038d9e8156b195038c9e7fe6
SHA1 6ea7b4ef0a088e765d7f9b339516fad5adb55aa9
SHA512 ec01d8e74974a2b4de69cbe462bcb9a2fd2d7496eb12f46d62ffda70feb8cf0231cf1ad5cad57118ccc6c48fc353916ba1faf5ef757e3414ccfa63caf1f99e69
SSDEEP 768:prv+4UNbdn30VPKWOp8+p3bd66j+4BRv86aLIWUD:pbsbN3oI8+p3Z6n4yiD
TLSH
T17903BF72F8A8D9738CF6C644B24676437FB8119396C01EE4E4DD6B4E019B1AE670B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4908c076f137a62dbfa61707608ee6ed303118ac7f6d9571bf25af1fcef464fe
MD5 754c3fbae9ece8af3f0b6eace7342c95
SHA1 8f7547a38d8d73d0917f6f5b1600e23b7840e1c2
SHA512 984c877a7112308148ce14aa94c6e47139d6a85aab4edab9b9a092f4b6ac0c5cd5852d872400d725131d4ac3bc5842c4010d86a1781489b48f1397986f6e6cbe
SSDEEP 768:Zrv+4UNbdn3TMPKWmp8+p3bd66j+4BRv86aLIWUD:ZbsbN3mQ8+p3Z6n4yiD
TLSH
T1CA03BF72F8A8D9738CF6C644B14676437FB8115396C01EE4E4DD6B4E129B1AE630B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 51fc425c1ead3ad290b9179487a3b7cf4ab7384c0f5992eafd40c59f5441ac65
MD5 e59c5057a6ddfeb05554c3f0fbc5f1b0
SHA1 943e203d3f2e1c2625d4063da8aceb5e2b2c9e71
SHA512 b08421a1a0e1f79a073dbb70dd1d924768cf2b9eea6ac344c696d509ef70510eac5c96045595895a1a9d214c07d47d526eacb1231dca441dfee6ab8f417a6f0e
SSDEEP 768:NFQr3kwgOqPKBp8+p3bd66j+4BRv86aLIWU/:cr3h8+p3Z6n4yi/
TLSH
T1F6035BF298D78537DCAD8B47A37D2E025EBCC063B5805994B3C86A0DDC561BFC30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 d72e87e967de6766c3ef928efec0c25c2077f301eccf51387a1da7e2fe2d3b94
MD5 a87a4e3b33e41733534357f8af9f4fe9
SHA1 01e7d937ce724d14d9b2f35d957404ba08a5ff7c
SHA512 c9d2db9702992fcd3d7c9082524e66f1b301572d6bfb07934637db3cece97a6427f6461f7a4c27bc9b2e9ace7480b4de3571d93177b93693211f31cbfedbb849
SSDEEP 768:NF0rv+4UNbds3TwggqPKEp8+p3bd66j+4BRv86aLIWUD:AbsbG3f8+p3Z6n4yiD
TLSH
T17B234AF298D78572DCAE8747A37E2E036EBCC053B5805994B7C85A4DCD560BFD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1d818c31307972be21538bf448b3679b78169dca095005400dd5f7b95c6579ca
MD5 cd650ccfb2cf0147996780ca8916c959
SHA1 a427545f1649ed04e05dac7a7d144d119b10508f
SHA512 eee1909b3cdfbc111cf8aa3c0b6acfa02e380b696c0223838ce686410d500dea358ac884d3a5f92b234517a207ee4fb972a89ce377b50b58907014f6b81f30da
SSDEEP 768:Irv+4UNbdD3OcwNp8+p3bd66j+4BRv86aLIiw2bwCl1:Ibsbp3eL8+p3Z6n4yO0ww
TLSH
T16203CE73F8A899739CE6C644B2467A437FF851A396C10EC4D4DD2B4E419A29E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ca21d9c-cb20-4c5a-9387-b8bc88651e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7ca21d9c-cb20-4c5a-9387-b8bc88651e50.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download