518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区备用网址.html
Size 1.3MB
Sample260724-ah2phadn4v
SHA256 518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9
MD5 77d8030e6ab130d612e2fbbe896dbd33
SHA1 94bcd98aac314e2e3088515e9ecc82de9d040475
SHA512 fc30b317253da5acdea37b39ae444e15a86284fc260459aec5d7081102aa4b607424558686eaeb58a71b8474f49184353cf7b226aeea30d04c92c25e4db49707
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++P:Eav2F+YhwIT
TLSH
T10D550051D81A40B271CE05A23EAFE25E263D7A1B9FCD1B494D2737EDE07260DB09CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293256256686355"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{45C27AFD-195B-4158-8E70-01A6CE338689}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
364	msedge.exe
364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 448	1660	msedge.exe	85
PID 1660 wrote to memory of 1536	1660	msedge.exe	86
PID 1660 wrote to memory of 5176	1660	msedge.exe	87
PID 1660 wrote to memory of 5176	1660	msedge.exe	87
PID 1660 wrote to memory of 5176	1660	msedge.exe	87
PID 1660 wrote to memory of 4444	1660	msedge.exe	89
PID 1660 wrote to memory of 4444	1660	msedge.exe	89
PID 1660 wrote to memory of 2856	1660	msedge.exe	90
PID 1660 wrote to memory of 2856	1660	msedge.exe	90
PID 1660 wrote to memory of 2980	1660	msedge.exe	91
PID 1660 wrote to memory of 2856	1660	msedge.exe	90
PID 1660 wrote to memory of 2980	1660	msedge.exe	91
PID 1660 wrote to memory of 2980	1660	msedge.exe	91
PID 1660 wrote to memory of 1764	1660	msedge.exe	94
PID 1660 wrote to memory of 1764	1660	msedge.exe	94
PID 1660 wrote to memory of 1764	1660	msedge.exe	94
PID 1660 wrote to memory of 2472	1660	msedge.exe	95
PID 1660 wrote to memory of 2472	1660	msedge.exe	95
PID 1660 wrote to memory of 2472	1660	msedge.exe	95
PID 1660 wrote to memory of 4624	1660	msedge.exe	97
PID 1660 wrote to memory of 4624	1660	msedge.exe	97
PID 1660 wrote to memory of 2316	1660	msedge.exe	98
PID 1660 wrote to memory of 2316	1660	msedge.exe	98
PID 1660 wrote to memory of 2264	1660	msedge.exe	100
PID 1660 wrote to memory of 4668	1660	msedge.exe	108
PID 1660 wrote to memory of 2252	1660	msedge.exe	109
PID 1660 wrote to memory of 4724	1660	msedge.exe	110
PID 1660 wrote to memory of 3356	1660	msedge.exe	119
PID 1660 wrote to memory of 3356	1660	msedge.exe	119
PID 1660 wrote to memory of 364	1660	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区备用网址.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffec4d9c188,0x7ffec4d9c194,0x7ffec4d9c1a0
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,14679242353779291490,16135145565300194072,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,13181642089425586264,7648718182021434994,262144 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,12928796841922010321,11204185980833925398,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,7230972593326812704,14929876839607261115,2097152 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15028885937969319697,948760902418100772,2097152 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4788,i,10614987015337732850,7304992155494192416,2097152 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3436,i,8059439322792551489,3610603488831848344,2097152 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,14883293484276808243,8892175423946421956,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,1446633413601322866,10866394646520374150,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14749651716592557773,15762688905399663558,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14749651716592557773,15762688905399663558,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,1489666674701066253,857038284091329838,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,1453649655569045997,2017061705312932033,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1760194035642862547,16389135086326862130,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,75555444883427557,13418540478113169321,524288 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,8977461201984349759,5759691289103722088,262144 --field-trial-handle=2304,i,951072153095193835,3112461362536779136,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1721356aeb4f660e3de5ad2fcebd140f86b3e579ad04f5a95872d42a897f84f4
MD5 09a1ed541948b8a7ed649f96e6e3a663
SHA1 d111830c529312fab838f3da02959ade3c45e62f
SHA512 febab4b93d47bbc4252e6d32cdd89efa09def72793ccc6e525779fd07c1581c209b827c8a5812fe3c666ffbef5e825f2301b32c0ce98523c0395dc56882e89f2
TLSH
T17BE02B6ADC21EC3708FD4718605D875AE74013573651495F3A3C82098FB462696C6C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 233ef8c6a609f40093b8151a2264249f23302855aaf1bae16e76a8eb42a93725
MD5 dee49da423808b4756de14dd1ec6dc40
SHA1 df7ce4917785330933f92b7bcfb803f8377744af
SHA512 c7da4264f7233f0fa6c617225bf73d4d505166ab41029c8033565e1b586757d80cd698e3f44d97ee3bf5fdc30c30f4aaa4de12ffbdf3a605639b88005be710a5
TLSH
T1DE516E365F40F313EF4A4330B5E1C196302299E4FC062AFA994070BC9ADCA2F8719E48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588c6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588c6c.TMP
Size 2KB
SHA256 a6b1af16f85bc00b92665bc701df9c5db71eb7d1898a32f9a618270725a25644
MD5 784be47aa8dae4c96d3fe93a4f9b1316
SHA1 7bc03b8936f4d4d543e57a70c1f002d88c0288b8
SHA512 99548f99f0be5277ced5b0179641f056507d99a4c4f0be43ec1567ef2ca27e35dc69e6ae3f701d7f3b6790c74adbf9a23c51cd650f7a8f3cc2e6e30cd5e08b46
TLSH
T1615172355F40F313EF4A1734B5E4D196306298D4FC022AFE884075BC99DCA2F8B15E49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d116db925dc44d88520c99d58fd9b5a693359ec7d72cac4cc88105921ab9265e
MD5 f2ac1ec83a5fae2b4be45fbdd06916f5
SHA1 68bf27ebafb53d73398e526fa63cc51ac95a241b
SHA512 52dabfddb644707debba6c24883d2d33314ddd93c6ab8258d19ecff6f1e2bb9d2188f49a151f562400cc60a60edff28835f21ad1fbb9e4d065878c41b95fa9f9
TLSH
T13541DDF783E4852EC91196F0AA187E2FCE5D0554832C3D9A89E4AF1BD3E3471E241A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5c679778c771b5b694221103e855e170a79dde4f4d0dfa8aa0df546e127d0efd
MD5 26517293012cfb7cadccd286acdb2f97
SHA1 a0729e2e4496bcbfc4c16d212eb9dda481d03184
SHA512 bb8a16eb859a32b6f6ceca0d02b7f8e80939cf8c048557eebb75f4522f8f0255395f0260a885b954e4f84ed40c05945b017c5734e8d43ed83d212d5ff5c1604d
SSDEEP 192:sxZWRAyMqZjK1Ml8Mka/fbssDTaZdYzodpHgjHW6+WNGYvIuDG7RTRIgj4J:sxZW5Ma/fbssDTazrWHbGV7njc
TLSH
T13F62E8166A3499778DDBD219FA55BF53D6F81163E2904E4499FC8B0C04EBBEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 535be35fd47eb88f5f3647223bbc1c301ec6546bd89d74a0205dc682365b9f62
MD5 57c2b9058e94ca168e69a1fb8e7761cd
SHA1 0b3ecbe8eca4f4e30310b8f4c9db1bf297380aaa
SHA512 970fa95525afc8cbb9146f75923355d3d0899a1d9cd85b67ae91f0c3972149a5a1b24543b80364b5e8bfdedc81cb87f8e575aece6fb66bd669a23d089fc54986
SSDEEP 192:sxZWRAyMqZjK1Ml8UQNka/fbsFFZdYzodpHgjHW6+WNGYv6DE7RTRIg5C4J:sxZW5qma/fbsFFzrWHbGi7nMc
TLSH
T10262E806AA3499778DDBD219FA55BB53D2F81163E2904E4459FC8A0C04EBAEC620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7a71eed752435b8ba16013b77d942bbbe564a784fc0f19693952dbb91c29da7f
MD5 5161aad2c6a4da75229a27592a8eeaff
SHA1 5e34ef7a47c687d0f4c7f9a81d5083ad33824a50
SHA512 2b99b0385094de1cd4aed9a95cfe60a485f62d8d61a1197749b08582ab44482ee87bb63de133ed29a1c9335f3f5326b26db521dd7a47fc2805e31a5473ce09e0
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9zx/ImlSGkcMHcS:0LppY93PBZJPtN53zZImlSGkcMHcS
TLSH
T13CB28C1A713E0212397E2988B39596365F4235A37058E4AF7FB814A14F27E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8e541a7ba7dd89d3d4201434101191ed927ab2c5c9271d566716f02727c890e1
MD5 416f02c1cfbf1fcd0b46d815a8eb404d
SHA1 ded91ac8e1adb951be19bcca4da61095bdc7b15a
SHA512 1198dd267ebda532b9895bf2d4ebbb3e2afd7bcb20b2c3aae257c589624823223deb55290546108ea07cccdc28d1609e17e5c101e6dce495138a8bc10b68823d
SSDEEP 384:nbiFiZcIgsNl8TUNTUlI4bQckCrPdcphiftGnKBqYb4T+WKOObjI9G6w7Kty/7IH:2FQgcwgKk8qoGwqYET+WK29M8
TLSH
T1DCD26B33E864CABBEDEB8B85B75A3A13AEE04167C69C9AC4D5DD5D0C009B4DD430BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e7ee66e6940af064f08b870c99f32b9df496b7cc505e03bb4e5cb7e1de49b617
MD5 193a1bc9cf627cfb3beb1c4e9b2c1485
SHA1 34b0efbd84f307c2065abc161040bc753ba8023a
SHA512 c829d07b80c54801c3a06f4eebe4a81476ebe39b040d9f5bfcca1db1a909ae6fd68babff61013e6f05d74e4287c905b6772145933285f9c97e8d797bad877a44
SSDEEP 384:npHiF9CcmyWCs3sNJ8TUNTUlIm2QckCr9lzKphiftGnKBqYb4mupme4KV8p0OHB9:pCFccps3QwgbkUxkoGwqYEmRI8p04n
TLSH
T1E6B25C36E868CAFBEDE74F89B71E7A039EE01167859C9AD4DAD81D0D10971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b5b71fcf3f00aa3222d25a640a73964590ee3335238c261175cd108da10a5722
MD5 7ca0e29bbe464184c9783c7e7e145e64
SHA1 66b6d05ddbff6d9a6b2f3efbe1c9bc4f8ec2917b
SHA512 003f4c62d11d90084b259d352d0744b6a214f43babc2bfa3879d38af3a939bc1fb0003393841d8581a4ff663a1ebfc512c207045fdbb33ada7246a636c5ad1b2
SSDEEP 384:npciFiZcIgsNl8TUNTUlI4bQckCrYdcphiftGnKBqYb4T+WKOObjI9G6w7Kty/70:pHFQgcwgKkFqoGwqYET+WK29M8
TLSH
T1DED26B33E864CABBEDEB8B85B75A3A13AEE04167C69C9AC4D5DD5D0C009B4ED430BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 233c62f4617e77270275015945af16dac8ff9a1d95a4973127df7df76cfe3eea
MD5 7dda224e4bfa5e1c5e9f259934bf4174
SHA1 33101919f1b1b9537f82c3273a8312270f6eabc4
SHA512 d4d73e694d32175c224f4b9c03e8e75d319f4a73a13a2ca57ecd9245919ebaf587ceba5c544df46e316dcccddd9fe4e6e9b03d5b5411bf4c3f2587b04baacb28
SSDEEP 384:nkiFiZcIHOsNl8TUNTUlI4bQckCrPdcphiftGnKBqYb4TKWKOObjI9G6w7Kty/70:/FQucwgKkoqoGwqYETKWK29M8
TLSH
T19BF2D4F298E78977E9AE4B87A37D2D0259FCC153B5885A84B7C95D0CCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7ef544394824581500b575872a500a3ffce11cf04025991a28fad319ebc3bb3b
MD5 2db8721bce0aa78e677f6de9cf8a2b50
SHA1 b9da2eae97a5e7725142fcbec6c222ed0ff17839
SHA512 943c2527c36bbd87b0f2cab0ecd33a6ad138e6ab9d26aff06aac081022e8d01800e69e9b9736cc349a4a04800c84094789315d7b392096754d6f8ffd98f428ee
SSDEEP 384:np6iF9CcmyWCs3sNx8TUNTUlIm2QckCr9JHZphiftGnKBqYb4TFWKe4KV8p0OHB9:pxFccps3swgbkUBHoGwqYETFWKI8p04n
TLSH
T1EDC25B33E868C9BBECE74B89B75A75039EE04167C58C9AE4DADD1D0C109B1DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 27c6a8496b647fdfdeb17744806aceca3f584405d3bd079ebce221d82c983035
MD5 5b6b67cf5f7513391857e579e4f4ed0a
SHA1 2fc3941336db50efb64b53ad07b43d588651eca9
SHA512 69a55a1a45eb20098095ec10c338e8cb146399965399e73579d631fb3e8e2d8904006b641d12bdac6a14784be0ab6fc3da599cd6b6da3f85b8ce8225335f41eb
TLSH
T1AB41295DA7F90104B3B76E5A9BF6A8AD487F7C772E06D59D10010E4F0632A40D9A173B
MD5 SHA1 SHA512 TLSH

Submit Download