518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区备用网址.html
Size 1.3MB
Sample260724-ph86xazdph
SHA256 518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9
MD5 77d8030e6ab130d612e2fbbe896dbd33
SHA1 94bcd98aac314e2e3088515e9ecc82de9d040475
SHA512 fc30b317253da5acdea37b39ae444e15a86284fc260459aec5d7081102aa4b607424558686eaeb58a71b8474f49184353cf7b226aeea30d04c92c25e4db49707
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++P:Eav2F+YhwIT
TLSH
T10D550051D81A40B271CE05A23EAFE25E263D7A1B9FCD1B494D2737EDE07260DB09CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293695937958115"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{208463C8-B691-4D57-994E-C2B6E7AE681E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 3460	4316	msedge.exe	86
PID 4316 wrote to memory of 4340	4316	msedge.exe	88
PID 4316 wrote to memory of 2244	4316	msedge.exe	89
PID 4316 wrote to memory of 2200	4316	msedge.exe	90
PID 4316 wrote to memory of 2244	4316	msedge.exe	89
PID 4316 wrote to memory of 2200	4316	msedge.exe	90
PID 4316 wrote to memory of 2200	4316	msedge.exe	90
PID 4316 wrote to memory of 1448	4316	msedge.exe	91
PID 4316 wrote to memory of 1448	4316	msedge.exe	91
PID 4316 wrote to memory of 1448	4316	msedge.exe	91
PID 4316 wrote to memory of 3532	4316	msedge.exe	92
PID 4316 wrote to memory of 3532	4316	msedge.exe	92
PID 4316 wrote to memory of 3532	4316	msedge.exe	92
PID 4316 wrote to memory of 2028	4316	msedge.exe	93
PID 4316 wrote to memory of 2420	4316	msedge.exe	94
PID 4316 wrote to memory of 2028	4316	msedge.exe	93
PID 4316 wrote to memory of 2028	4316	msedge.exe	93
PID 4316 wrote to memory of 2420	4316	msedge.exe	94
PID 4316 wrote to memory of 2420	4316	msedge.exe	94
PID 4316 wrote to memory of 3740	4316	msedge.exe	98
PID 4316 wrote to memory of 3740	4316	msedge.exe	98
PID 4316 wrote to memory of 3740	4316	msedge.exe	98
PID 4316 wrote to memory of 5000	4316	msedge.exe	99
PID 4316 wrote to memory of 2576	4316	msedge.exe	100
PID 4316 wrote to memory of 5000	4316	msedge.exe	99
PID 4316 wrote to memory of 2576	4316	msedge.exe	100
PID 4316 wrote to memory of 948	4316	msedge.exe	102
PID 4316 wrote to memory of 368	4316	msedge.exe	103
PID 4316 wrote to memory of 368	4316	msedge.exe	103
PID 4316 wrote to memory of 368	4316	msedge.exe	103
PID 4316 wrote to memory of 2012	4316	msedge.exe	118
PID 4316 wrote to memory of 4624	4316	msedge.exe	119
PID 4316 wrote to memory of 3732	4316	msedge.exe	120
PID 4316 wrote to memory of 2404	4316	msedge.exe	123
PID 4316 wrote to memory of 2404	4316	msedge.exe	123
PID 4316 wrote to memory of 3708	4316	msedge.exe	127
PID 4316 wrote to memory of 3708	4316	msedge.exe	127
PID 4316 wrote to memory of 1408	4316	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区备用网址.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa61dcc188,0x7ffa61dcc194,0x7ffa61dcc1a0
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,12238688097519337662,1247535951812472293,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,10279059029759829627,17142364976071176470,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,12180851404148012354,5536129470001968803,262144 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,8605172224171054997,344529805059013903,2097152 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,2105806716411496373,11231927006987765949,2097152 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,6727154421684874883,6952692867992980378,2097152 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,15757310986998857619,3228319344036674956,2097152 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3584,i,6130959949151999713,11889114441172705631,2097152 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,11395626946164491928,8315680519016412843,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,14396341647088070687,467347149999914734,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,6749253050500059377,206395228875625510,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,6749253050500059377,206395228875625510,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5004,i,1230813201427423966,17046135431127252341,2097152 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,7650580256468765109,11444463839702888276,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,10351613705066238952,17904690952182146007,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,134711719202057370,13128314993756591915,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,1265138258358460503,5930207176161556842,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,16225029426331996228,5360313684693826181,524288 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4164,i,5850613955316347784,14594355644906193970,262144 --field-trial-handle=2756,i,18187404244245948184,3206540346986793248,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cf2367c0bdc93ea54d540ed1b799010268b8ef505a8ec7e10aa5ca68d8996e63
MD5 5ba258a59fdedd46a557f9b128c6d369
SHA1 0525b5c730d53eb756c999cce99178a51694a16e
SHA512 bee2f5c1a9b5baac5e740bd9fc273b722886bf64bfcfaf14ab24cb6bbe06848ebd84e41dce844a750b1c1ae9e87dd48ed621d2d6f833d6953c2f2d2804d82296
TLSH
T1BF717FB1150EB8A9E35E01389CD25E0D7F3240E8F5137F7D1A508F75152D72881FAB22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c2fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c2fd.TMP
Size 3KB
SHA256 598fdd93cf11fe029f67bcb1317eabe7a2540639ab5bcf73d5c1629cafea9123
MD5 d073c3e10c7e79369266ea742599cc30
SHA1 5feeeebcb3f894b2ea737d6357f0ff40308c5c52
SHA512 e6c443c5dcc4f0b598029a3a2b147cddfd0fdd428686a431fa995791d8ca8e17eaf63d4e145817a015901fbca31c36b1ca84b478396193713f14a157337d467e
TLSH
T189716FB0150EB899E35E0138ACD25E0D7F3140E9F4137F7D1A508F71551D72881FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f13a2127df4795d1ee20dce4a52980a9e1af8d6a48e08501d2d9fd6e475f97e1
MD5 297b92cbf75db307dc8fb98c3aeb8d02
SHA1 2971e565ece4861204094abe5f1730e2063eef41
SHA512 d51e6bc674573d2d9bbf83dfd22455a166c9b7789922af5f77974a81334538d13b7fe227eb79b06178c18e5cb119ec44ba3e5fc534a190e78ca65a2a0b8b00d0
TLSH
T1D331DBF3C3E5852E891516F06A186F2BDE5C0A4583683C1AC9E5AF0FD7F24B4E20584B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4b922f89b914cc077af08892aec28165d0e88c7685f6a7301ff64f712812c772
MD5 a3c42a5c19285191df1e6a157a90edb4
SHA1 aceacc4accbaed3f90be2eb8e079bf663a875c6a
SHA512 93905d5fd7581164932fb574cc2437bcf2cb7436bf2aaba361a17d25b9f2fb89ae883e54c353c8c2249c6a1b680febfba629de7fb1f2bf0aa3060134189f660e
SSDEEP 192:sxZG0RbyM/jK1Ml8UQoky/f0sPOrd3IdpHYFHW6+WNGYz3jz+5Ig5YJ:sxZG0lqLy/f0sPOr6IHbGUS6
TLSH
T14252D6566A349977CCDBD209FA41BB93D6F554B3D2940E44A9FCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 48b194cb96aaf5a8539da3a9543c0273f9c9549c6bd27e7f2079225df66a5ba2
MD5 4f060a29b0b3ccfe3cd5616c855841b4
SHA1 233737f11828ced1d103d76192b3988e56e32b52
SHA512 b739a81f1b3b1d5f3e998f95b95c204e0420d3b3ec7c6c826f8fe79cfddbbb940c0647bbbdf3014f53ed4275ee507729b53ce092717641df22d84bc55a056458
SSDEEP 192:sxZG0RbyM/jK1Ml8Mky/f0sZORd3IdpdYFHW6+WNGYzQYz+5IgrJ:sxZG0lMy/f0sZOR6+HbG4S9
TLSH
T13042C6566A34A97BCCCBD209FA51BB53D6F51473D2940E44A9FCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f6f1d8ce51537d0294491cf2808caac5ef42de9e2193737bb9b619a73b9ac958
MD5 3c92af8c5ccee3e083f5c71bd67fe676
SHA1 a96edefb087f5d4b3a419d2a90689bb8ae9c1074
SHA512 a82487556a0624168860eae7915b92b1cada0157817d6c19dbf30c5d436132dc05da9b8143d9792d122e92476d4bdaa45e75ebc51d416ae3e64d6a75982c8f1e
SSDEEP 768:BAW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjOroIJi1Yw:BAW7kf0Wvqidau1jaa5LA3jFAw
TLSH
T1B7D2FA3B680CCB7E4F840E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a5382446ccdeb08e63792839d8c69b2ef08770ec6795784dfdf4303a8ab6b3ed
MD5 e75d00eab45917111d834dfc1e30cb21
SHA1 ce75709a51f7c517f5bd99eb2a99ce741b40cb64
SHA512 239962d962e8b7c220d6a5a14110df5fd39af1c869738c779f6e9aba9d363c6185ff0d07e10205a50dfc0c257e25d25f10f0014b8ed37c687ec2ff3c2e830663
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT73sbnR9JkZ9uPIufkKjB7pkPH08ORH5yljIBKIwE4TF:KIbCKcrUAKdamuj6KIwvT2KUYl
TLSH
T10E915B16323B0A123CBD2849B39586378F4271A33058B4AF7F7950B95E6AD224DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595356.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bdf2e4d83ba450ae76af2375d6d99d97e2e61628371ebbb1646780aa2c7a1afe
MD5 ffd80fee625ad91e6eabbe439585adac
SHA1 778ccfbc9f048bce9bcd77d43fada53907d0a281
SHA512 dfff597dfefd00951d22287ccdebbcf4bb6c69fd88ab23403f7748fef9d586f3af358810830ed159c859897668cfb6cd74ddc796bd8da3d9397929d0553ef888
SSDEEP 384:6iFiZcIPzsN08TUNTUlIluKKTIvbws0uSd3UCEJrJAOObjI9G6w7Di:xFQrlwgndh4YhJA29M2
TLSH
T184D229F248E7893AD96E9703E7BD2D028EFCC167B6845A44B3D99A0CCC565BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dd04de4545910fe300a78c37d5942ccb3638fb3c9cfdaf7b2a10e67fed65fbd8
MD5 a02203a4f3f79d4c887d60cec39f5c5d
SHA1 b0a65c786936754ae8b9e44948cb93b4ebd4884a
SHA512 bd59ee585a03240a550fb70bccda4d57e882b16f0d08e84ef4e04e42837347b8e8cac6972d109ed26847104acb45ba19d510269c4304560344db9694f171dd88
SSDEEP 384:rZcIhsN/UuKKTIvbwS0uSd3UCEJriAOObjI9G6w7Di:zhJdf4YhiA29M2
TLSH
T1B6929D319C799D379967A111F8C63A179EF4917BE7C81F48B2FDEB0C059BAAC0312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4738f0a12d46dba7aa962a911af0cf90fff4e7fab3c3c2aaf0dfb0e5e741fe46
MD5 11e56034a9032ff9790b473c5db27805
SHA1 6bc18d9ee557a677ce43df963dd0b142a7b9f23e
SHA512 5d277138f5017e57d7550497960ccf98626524d2b3cacfc628920fa454ba9323d9bccfff5f031b9e205ab3525102113451cb5ae58419f1963932a56df2723a51
SSDEEP 192:MONi64BAQmiUys1TW5GBPKb++FdG2MaDOtWU6:MONi6eAPtWNd39aWU6
TLSH
T15002FA34AC796C7B9EA2AE45F58637175FE8113BE6C55F44EAE85B0C009774C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 502a709710bc91d1f405fb0efb553edcac3dd4bd0831201eb16f794a14d158de
MD5 55936cc335efd9389ebcc08af3b4fd85
SHA1 24f456f18917c484cd3f2ab91e2213ded254876b
SHA512 f4a794472b07dc53af4bd13bfb46ea2ed6a6d211ac59cc9391e080bd684ad2558e586875e15b5b1a3516f26bdcf1042fa53cc496fe64dd2250ce90afba32154b
SSDEEP 192:7ONt64BEQmiUy8Tf5GBPKb++FdG24RFC1SJro3WwLqzU6:7ONt6eU9fNd3UCEJrkAU6
TLSH
T1D812FA359C74AC3B5D92B541F48736175EA4413BEAC96B44F6EC6B1C01EB65C2306C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a3498ac4ccf4013842f267d3a0481a4b3275c00854d2ee668098e96021f06756
MD5 e457ea1705b3d4ea5b701a8e2f99117c
SHA1 1a61fe9ebc95f3218d6e08fbf482ebe10c9840ab
SHA512 406633e3102b283f440401578d9b6b34541d40cb54a8c4b5abc80a5c16c0e7f77acaf64e2a1b74e0dfe1bc02f9b3ce03b0a7a6328f187d047535ef94511919df
SSDEEP 192:uoLsN/UUQJ8aKTIgQxBb6RQmiU1XM0B4aGBPKb++FdG24RFC1SJrohdNLqzU8:BsN/UUKKTIvbwS0uSd3UCEJriAU8
TLSH
T1263229356C74AC3B59A3A241F54736139EF4416BABC82F88E6FD9B0C05DB79C2316C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e4d4fed4b13fcd670a742d36112744fbe7e39fe6b09ac721107b845685fa971
MD5 0747986f66493632bfbae35c55f9816e
SHA1 4086a07b1b33bf5855d4a89473a9e0b2bfe01f65
SHA512 7b981849b8af3a361a64d8ecf3ffd3453f17f4c7e8a61c63daf82d82f3ffede5930c765314bb6e9ddc3c718a679eb1843df6483fd651bf4dd1eaaf7c5345fd90
TLSH
T103413758E6F91158B3B76F5AABF6686D483BBC372F0AD09D10510E4F4A22B00C972733
MD5 SHA1 SHA512 TLSH

Submit Download