8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/__扫码.浏览&下载 _1024社区.html
Size 1.3MB
Sample260724-ph86xazdph
SHA256 8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333
MD5 15280afe83c4f878e148e21115befc55
SHA1 0b14258bda8d938b9912fadab12603b001ce801b
SHA512 1706e300c677e64e4c79936184c4f95a0e4d35222e197a119ff653b61f72716a91b15fb9c43e7ba02adfcba1e33f40d27285875e003f03279cda0be21a1fcf9a
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++J:EahIuyTFCseZ13FSr++YGqL/IT
TLSH
T14F550055D51A00A275CE056A3EEEE25E227C3A1B9FCD974D4D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293696683335087"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{985F81A5-B5F0-4203-AD88-0DC0AAA9F39D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 5564	4872	msedge.exe	85
PID 4872 wrote to memory of 1744	4872	msedge.exe	87
PID 4872 wrote to memory of 1944	4872	msedge.exe	88
PID 4872 wrote to memory of 1944	4872	msedge.exe	88
PID 4872 wrote to memory of 1944	4872	msedge.exe	88
PID 4872 wrote to memory of 4588	4872	msedge.exe	89
PID 4872 wrote to memory of 4588	4872	msedge.exe	89
PID 4872 wrote to memory of 5072	4872	msedge.exe	90
PID 4872 wrote to memory of 5072	4872	msedge.exe	90
PID 4872 wrote to memory of 5072	4872	msedge.exe	90
PID 4872 wrote to memory of 4692	4872	msedge.exe	91
PID 4872 wrote to memory of 4692	4872	msedge.exe	91
PID 4872 wrote to memory of 4692	4872	msedge.exe	91
PID 4872 wrote to memory of 5300	4872	msedge.exe	94
PID 4872 wrote to memory of 5300	4872	msedge.exe	94
PID 4872 wrote to memory of 5300	4872	msedge.exe	94
PID 4872 wrote to memory of 4160	4872	msedge.exe	104
PID 4872 wrote to memory of 4160	4872	msedge.exe	104
PID 4872 wrote to memory of 4160	4872	msedge.exe	104
PID 4872 wrote to memory of 5176	4872	msedge.exe	105
PID 4872 wrote to memory of 5176	4872	msedge.exe	105
PID 4872 wrote to memory of 3228	4872	msedge.exe	106
PID 4872 wrote to memory of 3228	4872	msedge.exe	106
PID 4872 wrote to memory of 4996	4872	msedge.exe	108
PID 4872 wrote to memory of 1464	4872	msedge.exe	113
PID 4872 wrote to memory of 4368	4872	msedge.exe	114
PID 4872 wrote to memory of 4344	4872	msedge.exe	115
PID 4872 wrote to memory of 5880	4872	msedge.exe	117
PID 4872 wrote to memory of 5880	4872	msedge.exe	117
PID 4872 wrote to memory of 4928	4872	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\__扫码.浏览&下载 _1024社区.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x248,0x7fffcecac188,0x7fffcecac194,0x7fffcecac1a0
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,5442572966733929390,1181246188682182472,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8132755391974789216,11203100492001975767,262144 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,12134328805676852708,447386432027952759,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,12650900884187073872,14844425103190035773,2097152 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8870631086751287536,2351156544327857086,2097152 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,5540825101877777564,7526861076328715822,2097152 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5428,i,12939296056370349050,13364028175077043949,2097152 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,7369531002941526192,2095766347224973204,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,11657049710757540251,11807189147562893383,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6378171537359599108,16859758899422413641,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6378171537359599108,16859758899422413641,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,7479093515831586691,10911091790817943013,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7404747848914462670,17557067346604613209,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,17739212716644557833,13265324292289260852,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,7119597971470326007,7674528878086886447,524288 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5844,i,12209723362666093648,9720751755781309861,262144 --field-trial-handle=2220,i,9785249666020242411,7183310377342835684,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0b2d2bc1-2f8c-41d0-8d11-bdc8f443fb63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0b2d2bc1-2f8c-41d0-8d11-bdc8f443fb63.tmp
Size 28KB
SHA256 333f7e99b87b315b24ac29b4be6d45a70586d3e40805e3ffa466201f9c132a69
MD5 b00bc727b2f06cfb094c7858fd2b3387
SHA1 51683a592f4017551c54a9183827b11c933ec1bd
SHA512 9052cf96bfafc6d3ab330dfe270a4cfab802339511655b5940042084f54ed1f5ddf6b2922a76295d95faf012599aa3fa08b96f3da4f57df2469d018d2787d1b0
SSDEEP 384:n2iFiZcIlsNq8TUNTUlI4OuQckCr8XsphifGGJf4KqPL7W9uUbOObjI9G6w7ORtR:dFQlLwgYkT6FGPqPnW9uS29MOh
TLSH
T1B4D25B32DC64C9BBEDEB4F95B69A3603DEE44263C6DC9AC4D6D85E0C00975AC430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29b2e86f-5bb2-47de-b4c4-56dedc5dbe2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29b2e86f-5bb2-47de-b4c4-56dedc5dbe2b.tmp
Size 28KB
SHA256 facc530e1af4acb1422bbbd1f01cdbd3cefe8844afc71c07cbd8b94528de81d6
MD5 90e82fe783c8914010eb3d41227bfd06
SHA1 4aac396b317152d1c54079963688258c864a8f35
SHA512 b29a26a99b77ebb8c6a44191282b30873caba8ec28a831f03ab39137634ccd0b4e12ac432e653d73710bbbe2c4c04a97a5f08928e4bc080a03360f0b62770a3f
SSDEEP 384:n6iFiZcI3TsNq8TUNTUlI4OuQckCr8XsphifGGJf4KqPL7WxuUbOObjI9G6w7OR/:xFQDLwgYkT6FGPqPnWxuS29MOh
TLSH
T135D25B36DC68C9BBECEB4F95B75A3603DEE45263C6DC9AC4D6D85E0C00975AC430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

591d9c08-8c88-423a-909a-4fc79e65db7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\591d9c08-8c88-423a-909a-4fc79e65db7a.tmp
Size 14KB
SHA256 72f5a55cd3d6edb584d63f9ed9a3f249989c4e65581b4d36351f7d9361bca0d5
MD5 5b8e220b1d8f7123d94cd14ec30b9c6b
SHA1 5d614d5df168a608bbfa74e639c0fde28c4ea194
SHA512 ddaa21ee0b058c22b0b5148840fa3b3d452bbe028dc58e1d7bb6bc9bd46bda4c2dd00a25260fbe58072ac2521936c20727b2818007afdf6d65118d5bebee3899
SSDEEP 192:sxZ3Rc7yMqZjK1Ml8MkO/fussSWaZdFzodpHwHW6+WNGYvIC+UQuIgjtJ:sxZ3aaMO/fussSWazOQHbGr8j3
TLSH
T17462D7066A345977CDDBD219F645BF53D6F81563E2904E4499FC8B0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b805d166c4b3df028966cdd80407a3437fe43f7f421fd326c338b6ad8e2b88d5
MD5 5849c658e21ff013201b289519afefb9
SHA1 a913dad1bddbcc02d9a06ff6654819bb6dcc39fb
SHA512 abdccee4615a437f7f6c384586fc998278b3d148b84d37f136e39e7cb2118f38a12acb193ac0f77e7aecff3f77109c9ab28e2a8fa75d4eb0af2ca9dd9e76565c
TLSH
T13DE02BBAC827EC2718FD0B28A0098646EB5117673640995F3B3CD20D8FB462656C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b67d88b3dc322aec86e9c8bb4eae5e7b1843f9d3b32d6ef6faf974265ccad4c6
MD5 0231a9c581015720e68bcba9ebdc762a
SHA1 f7218c84ebc9269df87b5e1d49b80a4b33cba0e2
SHA512 9a3909111924b1f7f40c3d6266828fa7f1d3eccb445627119e590492d8468da51400e8c9a1e945b8dcac397f1101dc6fb22abc6a457fa6e3803317a53f9d1136
TLSH
T1F351C336C34949AFE31146708CEF317A746071D8FA075CC08657887AA9F87B3CAADD18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f558.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f558.TMP
Size 2KB
SHA256 ef494a79c068d04f2a3e11292b7354d2a0b7b016c9ad2aadfce1356f668bfd7b
MD5 014fb543e03b038cf156a9dc87a3e8ca
SHA1 0df256af970048bcc3b2958b9d212ebe36c9e027
SHA512 15e1092baa1ec7de7d8185cf50551679e1c9769435fae1b2d80ad58128fb9fa93c2141f7d0ebc956a6028bd154dfa77ae4e51cff5043bbfd1a4e033455e1d321
TLSH
T15651E336C34948AFE31146308CDF3169B060B1D8FA075CD08567883AA6F87B3CAADD18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d6f8aaeab78cbccebee7e6963733dc7ed12ebdf3e5582bebffc81d2d314eca96
MD5 f3ca012f8e964343200d9612bda59b9f
SHA1 7e649ab53c2f1fb220b7884e863585be0525834f
SHA512 90f8b4277e8ccb70aebce32d03ff11ee9a4d671c177b859e1205936ee704e3450a6465284cc3e6df37f5304e2af8334853c9a4f5804242dd85afae0ef9643ddc
TLSH
T1CE41F0F783F4856ECA0195F0AA187E2FCE5D0514836C3DAA89E4AF1B93E3471E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b1d99262fa4be22635f1626338175d4a7b761141b1d2b1465021f7f1e1a4ffc3
MD5 b3b2b04c079b4609eb7545dd529bad51
SHA1 15afd8e20c30d499046e6e0b0de502e7f80e1387
SHA512 761bafba0cc6dcf292c35162074a0a6f55d728a34d95645a823def1968d97a559547a771ce9e9ad46ec27a34109da4ccc4ce165e120b8bf30398ef474a68a1c4
SSDEEP 192:sxZ8Rc7yMqZjK1Ml8UQykO/fus4/ZdryzodpHbTHW6+WNGYvtLgUQAIg58tJ:sxZ8aSqxO/fus4/zrJ/HbGjaq3
TLSH
T1DA62E81A6A3499778DDBD219F645BB53D2F91173E2904E44A9FC8B0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f999e71fa9455ec7f526a9d3c249b435bd4768961bbf894d5a98ff005b807036
MD5 2a8e316f4f107e3b03d87b9ab784f5e7
SHA1 30a9561be4aa6ed6c496c9e9812d1e29545386c0
SHA512 9c45f308d3817e07ad6b91e87fbaf7435021b9faaaf1469f3c223b56c4775445a812cef991c5c94b305076f2bbcbb456b54fbc5137db6fc56c8965b910a04098
SSDEEP 192:sxZ8Rc7yMqZjK1Ml8MkO/fus4/ZdryzodpHbTHW6+WNGYvtLIUQAIg58tJ:sxZ8aSMO/fus4/zrJ/HbGLaq3
TLSH
T10C62D71A6A3459778DDBD219FA45BB53D6F91173E2904E44A9FC8B0C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eb9159a75109aba03b655cec68c53faa9a2507ce4a0e6e4ceb3230095ee4cc91
MD5 dc3071f655e25726fc566c4ff50fc30f
SHA1 0f54df1aafa7dda2e611ae2a599c4e2241f3489f
SHA512 fead5912c60d06ab87c4773388f4e95eb0bfded6272deb4ceb66ef38161b5c1137849241afbb4c31f2fb085531fd1e0fd00b3715f10e2a3ef334de67b1b48d18
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J95JniRsT/BPL4TJ:0LppY93PBZJPtN535ZiRsT/BPL4TJ
TLSH
T177B26B5A703A0211397E2988B39596364F4235A37058F4AF7FB814A54F2BE225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8668b840c4a5740e79084f7bfcc50b9830d682e7ab08e051b44e4ed23aff4487
MD5 1ee0db41a1ad39f278abb212a229f500
SHA1 db66a9e456f241dccc28db2fb8939208de1aabe6
SHA512 d39bae60097632ca9b685d22a6468805c34fc344afed5bbd54491a148fe53cd0569a040b0352a9f3a83514992399fdb37f59bfbc270d0ffe740e8d5fc2f1de1d
SSDEEP 384:n2iF9CcmyWC/sNq8TUNTUlI4ufQckCr8XsphifGGJf4KqPL7W9uUbe4KV8p0vHdl:dFccp/LwglxkT6FGPqPnW9uSI8p0vMC
TLSH
T10DC25C32EC58CDBBECE74B99B64A3507DEE05263C6CC9AD4DAD85E0D009B1AC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3e4a420effaefeda0817aa2ccbb8cf7bdafcbee0be9f02bb55f9d3556f27efbe
MD5 fbed9e13486c80d613caf4a23e0caf75
SHA1 438613502151385f1dac810d448f7d83ea9b5147
SHA512 5ad8ce86d08d1cc730a55244c5980f2c6232ef6205b340adb9299cf1f8baa49019edab81d1592b7e28eca38118c773ab30ea174364e54b424485be15c38f64c2
SSDEEP 768:pYFccps3bwgbkUh3FGPqPnWOuSI8p0vzC:Gs3VDdPnWiI8p0G
TLSH
T16DC25C32EC58C9EBECD64F99B74A3507DEE45263C6CC9AE4DAD85D0D00DB1AC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 704ad9f898c8d7ef2d62498758e916d613a561b18a038abab2961abaef70d707
MD5 fb381dc83a36ce890a10cd9f48404a8c
SHA1 c88315b17c989221a4038a86c828e9732c30a869
SHA512 43d5fcb9161dded309ec2438088a3a51ca2f02869e047abc5500f81e11b4ae5c0859a8b4cbd8f8a67eefd4e46c50d25ffdeea53b0681d9ae5f008a9db15e204e
SSDEEP 768:pxFccps3Lwgtxkt6FGPqPnW9uSI8p0vMC:fs3pPdPnWRI8p0z
TLSH
T1DEC25C32EC58C9BBECE74B99B64A3507DEE45263C6CC9AD4DAD85E0D00DB1EC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 477c9afb35432dfe5c97017df4676e32219ebf19d55d810797109030c7467416
MD5 9c62cb3c6a22236f5be6f9ab5a7fd21b
SHA1 1a58f78d9d4e53443c050085a0e60758d4f0b952
SHA512 2e1e3aecfd655afb9b81b999da7d1ffcf231779886a191f39afddafb07a92dd49fa718c462a1cbf416f7d5ac551c6d22fcebe0c30b3dd246c867d7ca75ca8f59
SSDEEP 384:npkiF9CcmyWCs3sNX8TUNTUlIm2QckCr9ljKphifGGJf4KqhZpwe4KV8p0vHdtyN:p/Fccps3WwgbkUJkFGPqhkI8p0vzC
TLSH
T16CB25B36EC58CEFBECE74F99B74A7A07DEE01267859C9AD4DAD81D0D008719C530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8dadab9c292710c53598ab18f6a2bb66d001f768967d72b991a73d002281243
MD5 98c7ff02af402288eba717fc153603d5
SHA1 d2776c7d356ca3de555d8db9f16cf2cddbfd8ffb
SHA512 25a23f08553d8c2d0483c6cb2ce4db94af859360040ae84430bbf128f52ad5d5cd6567ccbb289d4662c5a67dbf69adf55ef0f753d8d07c43b9ae7c6b8e0cc88a
TLSH
T197412758BAFA1148B3B76E15AFF2B86D487E7D772E46D49E00110D4F0662A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4996-229-0x00000189DCCE0000-0x00000189DDCE0000-memory.dmp

Download