099297421ed292111003948ab788b95959dc327f3c4ece4262fae21340064ed1

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区_最新网址.html
Size 1.3MB
Sample260724-php32aywa1
SHA256 099297421ed292111003948ab788b95959dc327f3c4ece4262fae21340064ed1
MD5 191ed2f790ed01bd8f81e8fae3aa495f
SHA1 1e1bcdf57e82d2bb4cbf1dd3e1b666b1aec2cdaf
SHA512 5e7aed8ec76d17a5d895f695a1dac4e3104ad58b436474ff7f331c2473e4945beca30376c7d861eea908a3503e6590f68f419404086ac4a95d7eed765523e7e6
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++p:EaK2IuyTFCseZ13FSr++Y8xU/oT
TLSH
T18C550055D51A00A275CE056A3EAEF25E227C3A1B9FCD974D0D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293692656428761"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{A0FD617C-9DAC-48A1-810C-CC46D857A49A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3700	4776	msedge.exe	89
PID 4776 wrote to memory of 2632	4776	msedge.exe	91
PID 4776 wrote to memory of 4392	4776	msedge.exe	92
PID 4776 wrote to memory of 2632	4776	msedge.exe	91
PID 4776 wrote to memory of 2632	4776	msedge.exe	91
PID 4776 wrote to memory of 3468	4776	msedge.exe	93
PID 4776 wrote to memory of 3468	4776	msedge.exe	93
PID 4776 wrote to memory of 300	4776	msedge.exe	94
PID 4776 wrote to memory of 300	4776	msedge.exe	94
PID 4776 wrote to memory of 300	4776	msedge.exe	94
PID 4776 wrote to memory of 120	4776	msedge.exe	95
PID 4776 wrote to memory of 120	4776	msedge.exe	95
PID 4776 wrote to memory of 120	4776	msedge.exe	95
PID 4776 wrote to memory of 3836	4776	msedge.exe	96
PID 4776 wrote to memory of 2776	4776	msedge.exe	97
PID 4776 wrote to memory of 3836	4776	msedge.exe	96
PID 4776 wrote to memory of 3836	4776	msedge.exe	96
PID 4776 wrote to memory of 2776	4776	msedge.exe	97
PID 4776 wrote to memory of 2776	4776	msedge.exe	97
PID 4776 wrote to memory of 1796	4776	msedge.exe	99
PID 4776 wrote to memory of 1796	4776	msedge.exe	99
PID 4776 wrote to memory of 1796	4776	msedge.exe	99
PID 4776 wrote to memory of 5804	4776	msedge.exe	100
PID 4776 wrote to memory of 4420	4776	msedge.exe	101
PID 4776 wrote to memory of 5804	4776	msedge.exe	100
PID 4776 wrote to memory of 4420	4776	msedge.exe	101
PID 4776 wrote to memory of 4184	4776	msedge.exe	103
PID 4776 wrote to memory of 5456	4776	msedge.exe	106
PID 4776 wrote to memory of 5456	4776	msedge.exe	106
PID 4776 wrote to memory of 5456	4776	msedge.exe	106
PID 4776 wrote to memory of 4764	4776	msedge.exe	108
PID 4776 wrote to memory of 4536	4776	msedge.exe	109
PID 4776 wrote to memory of 5092	4776	msedge.exe	110
PID 4776 wrote to memory of 4564	4776	msedge.exe	111
PID 4776 wrote to memory of 4564	4776	msedge.exe	111
PID 4776 wrote to memory of 4844	4776	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区_最新网址.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7fff2822c188,0x7fff2822c194,0x7fff2822c1a0
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,18296623663504145733,14340499293764520279,262144 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,7194357067548795456,16628950922318468727,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,17574453734363936385,9988540829178112224,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,16590179462759601156,10804793334860288321,2097152 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,805311492475169592,1611864905530202427,2097152 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,11652153858398058313,14955269636045816110,2097152 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,6226951778736491322,15285208586713318035,2097152 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3900,i,12662950847516920742,10950179543150564980,2097152 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,11528386108427564130,13807342664153056793,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,6237753892605249708,18279253108908042497,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,8727954899220554339,10795531952812378952,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,8727954899220554339,10795531952812378952,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4608,i,11677811487340147868,12433423783895140139,2097152 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,12509953549459809421,5925074963825751535,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,14459467156826569279,4532484743628903023,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,1461429985642302276,6306673519893138770,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,18086601782836756584,2584306939258636728,524288 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,13247401235425931713,7527628202151621856,262144 --field-trial-handle=2636,i,12076101111836799024,12926423289989815005,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bd225531117250e9ce9d702b12380c1679048a20929339f35f0651e15300669b
MD5 9436079d526613156a71c70ead03b877
SHA1 e69d5d323e4b2f1930c430248a72d5ca7e9c58a6
SHA512 91f1e9381e640a0f95ee1d5577ef25b738ddec86d8890c8fbe8eedeaf047d07d9fe3cfb5285bd56709f0e19cdcafebc474301fef3139e1d3e54ac69d5d7b33f5
TLSH
T1FE51548203263AC1E77955F297D940D8B7F9B7A9490B5EFA120C1C7A4D0EF4480D912F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ca2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ca2c.TMP
Size 2KB
SHA256 cf47610ddb4c378837c5a118180d1b2a2d36571068fbd32c4995fa04f61774a6
MD5 269132fbdd8ac647ff00be43fcc7b93f
SHA1 d57834415b629580e71b5eba587e4554fc77bc37
SHA512 00a62349d06a5879fe3063f8eabbfb828bdfdc8d0f0225c20dbbd28d93436012497f91f51782d29febcb1a212c8fec487a47411fb8c52a7b5551c833e4358e7f
TLSH
T1C251638203263AC1E77955F29BE844C8B7F9B3A90C0B5EFA120C1C7A4E0EF4490C812F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f354c577deaa583d5f091bf0f8c052d07d9753be92eb8def99edbf3ade862ca9
MD5 b07fd4a9bc2da876f95a2e4b9d15063b
SHA1 80720266c5ab123933e5e87cca5333b24da506ba
SHA512 358a92e4e4ff8a2c1ebaf4e689710e7353112a29d3393ec72af263910af8f18afce79e248a7235e4d24b7317db0f55f822a56b894db60f0570d05e33b676c818
TLSH
T156618EF7C3E8862DC91156F4BB153F2BCE1D0918532C3D16C9E4AE1BA7E2871E14169E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 255eb7c464469f90638faf0c579d57b627fc8498fe45e8f77bf4e0f3cb4711b0
MD5 91da38170acf317c0176fee33342dd37
SHA1 4fc34a89d064e73c47522458b9af575f97c30d92
SHA512 b09cad3fe06ee68b1ac10a17dfe5055b3d34e523313201b0dab6d8d20b255f6af73e029a4237d07415203d6efa8fb71a5cc8ea9ff89d030c63296f908116f4e9
SSDEEP 192:sxRAR3yM/jK1Ml8wbJ/fDsTiP5HDde5lSWzoD8p4hk2/g6+WNIYCyuOTGQKIgDDJ:sxRAplJ/fDsTO5Hc5l/A/5IQ9KJ
TLSH
T1C562C81556349D7B8CDBD209FA51BF53D6F85573E2901E44AAFC8A0C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bbbbf0ad7d1e3bc89711ca134085c94c43b89179832193fe43d763803cfb1545
MD5 50164467f7e0c22c80993017f76086e5
SHA1 e56b6e696980a3968f60d8607c5901e1dfc21e30
SHA512 e30c4c471b89f7cd111b12968afdd0517cd24d335074104d149464ac9cf40b0c5944f899a03ee655bd88b082161480b7e536a7a9452cfe82bcc83d66d96de739
SSDEEP 192:sxRoR3yM/jK1Ml8wbJ/fDsJiP5HDde5lSSzoD8p4h/g6+WNIYCyuOTGQKIgIJ:sxRovlJ/fDsJO5Hc5l/A/5IQ9Ks
TLSH
T11652D8155A389D7BCCDBD209FA517F53D6F85573A2901E44AAFCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ee852aa52384e454034b7d4115396fdfe801800cd77632d52e6b4dd2837db8d0
MD5 f9094bf9e0eb8d5a8e8a5ea3457d9df2
SHA1 e1515c68bc12724f7cd62edd003dd16e07ebc8c3
SHA512 2391027d175c08aca0e9614dbf48d9e509f43b48666510aa8b28c9d242c01d6edf00c7f63dd2dc2ae4f494d2dfebb110f44bee24c73bbc71b73d60ba7ca112fa
SSDEEP 192:sxRAR3yM/jK1Ml8UQMbJ/fDsTiPicHDde5lSWzoD8pehk2/g6+WNIYCtuOTGQKIk:sxRApq6J/fDsTObHc5l/C/5Ip9Kj
TLSH
T18C62C81696349D7B8CDBD209FA51BF53D6F85573A2901E44AAFCCA0C04E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 27365ac3d774ece58cd0f08717b7b8a9ac90534788ec7d64f694ff1aae23a9bc
MD5 22e2f28413a46a4eb67e30487d9ca515
SHA1 3d883e997bc6340cd2388618b6e417f78bd21d8a
SHA512 67690193e845428ce9811b5d062b1b11623964db0097a96f0739bd4dd99a16c19713e9220be0b89991f33d1d0ac87b62daee4c9af1a1037b8ec9d059450c2727
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqKrovX:j/8vrQWgQ+fB+u1ja3Vqhf
TLSH
T1B6C2EC3B640CCB7E4F844EADEC29BED66DD801CF5B588D5447EA890C03C67EB521A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b5b0d1f91a1bf9b36721f6b748cd70513a32a8d2a4d8c3793a98ae452133f6b9
MD5 b3744fd2083c1c3c2d68734793edc5e3
SHA1 0a25e14c1bb633cdbc3e7624e39956a566ac3965
SHA512 d70e27acbbfffba563fd5464d6f32dde1288f33554c8f1151232be6ca79bcd5aaddd8dd9121f3b38bfae68d4ca5454750426114cd220ad3d0633cf7531317060
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unudGKO:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOowW
TLSH
T1E991A441B13A4245397D791C80788D3ACAC1F47B301DA96B7BA891A70F27E46EDFD9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

8f36b13e-b182-4aad-9bb7-ac2bdd980758.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8f36b13e-b182-4aad-9bb7-ac2bdd980758.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 668ee2c544603e00d47e979b80b807e315e8d384cc06e1dc5e8492ce40e7521f
MD5 8e6e06f5f0b6c8aec4025742dc24bbe4
SHA1 1c4c89d47b1776da1b36172e899858e43d0dca32
SHA512 204c5399b23bb9a5372c420a2be5b0c988c15be5bd2a73975465f20c5b60353e6b544431349afbab808b8a84f0a38743307f4dd05a2b93f3bd73eb446cc7f510
SSDEEP 768:E63bRsX/Ep8+p3bd66j+4BRv86aLIWCb9MD:E638/S8+p3Z6n4y0b+D
TLSH
T113F2AF72FCA999738CEAC654B18676036FF451A7D2C01EC8D4DCBB0D019B16E570B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aa0730867d3c03e595287494dae51e8be1660b804b511a7d093a9641986fa0aa
MD5 c66583de31c674f07304c8bd0c77cba0
SHA1 7b21f47b39392c09b92eb4ac5db702c03c6e2d82
SHA512 87933b6ad8113ac774f2a4e5d695966386cee65228dd2009e1b7c99c3b1efe7c86df03d3a22c3d86669d48e4c10a3d2856e5709b44ad00c0674986be9d657f07
SSDEEP 768:4rv+4UNbdh3qsX/0p8+p3bd66j+4BRv86aLIWCkI:4bsb33d/C8+p3Z6n4y0/
TLSH
T15D03AE72F8A899738CFAC684B14676437FF8509396C01E94D9DC6B4D019F1AE670B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b02fafd2b0ca8ee978eacfa077c5ba9059e1b3aa4aa311e8d05fe091f453d072
MD5 c221096bff36320039e913b008e03b9c
SHA1 1b6ed3efffef298d2b27e258752e02dc26f8d257
SHA512 f8327a80b4b2e7056196e85d0401d84cc01c05be645aa41924d3ea2afdffadec787db5bd529f4f29ccf7bce943ec48cefcefcc340775b0e17b112df4d95f7688
SSDEEP 768:U63IRsX/Ep8+p3bd66j+4BRv86aLIWCb9MD:U63L/S8+p3Z6n4y0b+D
TLSH
T1CCF2AF72FCA999738CEAC654B18676436FF451A7D2C01EC8D4DCBB0D019B16E570782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a5cff18a450da18ab555daacef103d74c3951e4808134da8f92b244441ecdadc
MD5 93d22cb26838a8356e7e3f3691c8cf01
SHA1 2b8d65fecb254c4cf0c41660aa9b101ed8d256b4
SHA512 de0161eb4446fb5908e0608997ba5f8e19bf2d142a8892fe9df3f36b63fb305e8c49a70638dac5edc246501b4fd7ad2f9d5f8ebf993a1c6a416b96300a40f885
SSDEEP 768:5FQu30wgeDsX3p8+p3bd66j+4BRv86aLIWCb9MD:4u3458+p3Z6n4y0b+D
TLSH
T13B135BF298D78976DCAD8B43B77D2E025EBCD1A3B5805984B7D86A0CCD5607FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 332b94a8bb11b5b0e0dc43e99ef4111a6c151b40a62a9d4ad9734a02630a24a2
MD5 8c4766c4af7fa459ec14cdcf7c698ef6
SHA1 2489853ffeb0469312a6d81fc3906fb5b185bbb7
SHA512 081f1340cea9d1cce6b44ec8410060660fc7eca07384da22352dd2313f217ec831fa3fb9b2ca92b9d0137a3dc7fd0ff73ffe2137f002e8ff194ec864e4428e5a
SSDEEP 768:Irv+4UNbdD3+ccNp8+p3bd66j+4BRv86aLIir2bwCl1:Ibsbp32L8+p3Z6n4yZ0ww
TLSH
T1C103CE73F8A899739CE6C644B24A7A433FF811A396C00EC4D5DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29495a18-858a-41e1-bf3b-7c47adc5cbe5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\29495a18-858a-41e1-bf3b-7c47adc5cbe5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download