518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区备用网址.html
Size 1.3MB
Sample260724-php32aywa1
SHA256 518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9
MD5 77d8030e6ab130d612e2fbbe896dbd33
SHA1 94bcd98aac314e2e3088515e9ecc82de9d040475
SHA512 fc30b317253da5acdea37b39ae444e15a86284fc260459aec5d7081102aa4b607424558686eaeb58a71b8474f49184353cf7b226aeea30d04c92c25e4db49707
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++P:Eav2F+YhwIT
TLSH
T10D550051D81A40B271CE05A23EAFE25E263D7A1B9FCD1B494D2737EDE07260DB09CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3852	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293693301897955"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{CB7BD6F1-9EA1-4FF2-A32A-D75569387D71}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1440	820	msedge.exe	85
PID 820 wrote to memory of 3852	820	msedge.exe	86
PID 820 wrote to memory of 3016	820	msedge.exe	87
PID 820 wrote to memory of 3016	820	msedge.exe	87
PID 820 wrote to memory of 3016	820	msedge.exe	87
PID 820 wrote to memory of 1588	820	msedge.exe	88
PID 820 wrote to memory of 1588	820	msedge.exe	88
PID 820 wrote to memory of 3084	820	msedge.exe	90
PID 820 wrote to memory of 3688	820	msedge.exe	91
PID 820 wrote to memory of 3084	820	msedge.exe	90
PID 820 wrote to memory of 3084	820	msedge.exe	90
PID 820 wrote to memory of 3688	820	msedge.exe	91
PID 820 wrote to memory of 3688	820	msedge.exe	91
PID 820 wrote to memory of 3480	820	msedge.exe	92
PID 820 wrote to memory of 3480	820	msedge.exe	92
PID 820 wrote to memory of 3480	820	msedge.exe	92
PID 820 wrote to memory of 4028	820	msedge.exe	93
PID 820 wrote to memory of 4028	820	msedge.exe	93
PID 820 wrote to memory of 4028	820	msedge.exe	93
PID 820 wrote to memory of 2448	820	msedge.exe	97
PID 820 wrote to memory of 2448	820	msedge.exe	97
PID 820 wrote to memory of 2448	820	msedge.exe	97
PID 820 wrote to memory of 2224	820	msedge.exe	98
PID 820 wrote to memory of 2480	820	msedge.exe	99
PID 820 wrote to memory of 2224	820	msedge.exe	98
PID 820 wrote to memory of 2480	820	msedge.exe	99
PID 820 wrote to memory of 3792	820	msedge.exe	101
PID 820 wrote to memory of 2820	820	msedge.exe	102
PID 820 wrote to memory of 2820	820	msedge.exe	102
PID 820 wrote to memory of 2820	820	msedge.exe	102
PID 820 wrote to memory of 5096	820	msedge.exe	109
PID 820 wrote to memory of 1900	820	msedge.exe	110
PID 820 wrote to memory of 3720	820	msedge.exe	111
PID 820 wrote to memory of 100	820	msedge.exe	119
PID 820 wrote to memory of 100	820	msedge.exe	119
PID 820 wrote to memory of 4372	820	msedge.exe	122
PID 820 wrote to memory of 4372	820	msedge.exe	122
PID 820 wrote to memory of 3708	820	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区备用网址.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,11078057893162196802,15499224064669728266,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,4601071519573720327,1624329846960764627,262144 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,16558479484471353254,18453105528899260,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,4365423443087909822,16137790734177655404,2097152 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,9808762011256993883,11911317700626822863,2097152 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,10351446707632459552,18233613566645297371,2097152 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2846097287613960791,2104345576880705790,2097152 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5232,i,8175992244463126213,18063191313563396465,2097152 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,1364894666656930151,10403653112861221859,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,18141324809761891646,16227258088862212454,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,16256959123588733734,2219975932167634106,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,16256959123588733734,2219975932167634106,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5188,i,2351726603316104865,17970520736885898626,2097152 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,7753487355755697461,6672288679736745089,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,6377868156948672262,12443699421896463737,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,12210631405212902920,11176054726808684412,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,17655007943980621955,1671561777567299252,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,13651207460005596419,12824448864672557271,524288 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,17334462533079928994,6739989628884510482,262144 --field-trial-handle=2132,i,17142562786931758952,1972492056306050325,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 48c1c9bd552045cb3f1f41b3411889c08cafc2adabbdb899e4dd5cff844025d6
MD5 6fc5e15e19cbb231ec4edddad276e628
SHA1 33977752924669a6ecf0fa49ea31b61a71788856
SHA512 4565ea3eb089c65b9c2837ca2d47c178d4b970a4866907c3b5dcea4aee6efd56bb80a8782074d498521f534578d1f11cb00220191f71e47539feeb95ff19bf0b
TLSH
T1BF613D380B5E1482E3A156B1B4E20104707482F9FFDFDE4EEF149DF55A3632AC9924AB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cd0f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cd0f.TMP
Size 3KB
SHA256 8d39ab9de3c7c495c2890794b0df93fe0a049ccff9885dbf6789a21abe4dad3e
MD5 3c4d43774e44cf669c8ef58b59f0ec88
SHA1 1e65e29a46d790afd24afa385ca88480569e280c
SHA512 b750e22ae24d5056695f18ee0a924704b9cd3e83b85fe12081e26571e6e7624f5360bd71d9bd907d2644ac837a934913deefd2ec3ec63251e2050d3f921e3b27
TLSH
T13D613B380B5E0482E36116B1B4E20104707083F9FB8FDE4DEF148DF55A3232AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a32cc9e0330c49c38fe9987efc049ef05b7535c6b431be3c36895f2e38ce2b62
MD5 01bd5954e03850bd31ba4ae13ee16e0a
SHA1 d827413a86048e1dfa4213730f276110c0b374ad
SHA512 02c7334a31e64e99cc1c309948bf00f3525836d3af0bb894323216285e47ccac67aca5b6580fce5561d4ecb98c0dc21c97e73c9bb74fb2d407d079907953cdb5
TLSH
T1A431BBB7C3E4852E891156F46A14AF2BCE5C0A55836C3C1AD9E4AF0BD7E3874E20184F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f72e566a44c3bb1a169d438803d21076094ef8c6e0fc35e46ea43dfedd4f60e6
MD5 ac25db02bb43d500399d9cb16e9b2576
SHA1 cc5b22042a83b0cf7562a45d141815616d1e62c0
SHA512 2588d3b80e1e3ff0bfdbcc5baf4d8e84aa522144c3fa4ad97c80bd56e6d6ec29737e0c39d9ca1bcc4a840f7e386a28c3c135114d0953ed63d07a6df8dcc365b3
SSDEEP 192:sxZNR7R9yM/jK1Ml8MkEG/fdsYN2IsIdpdTyHW6+WNGY9IKLHW9gIgrJ:sxZDfMx/fdsYNDcHbGU9
TLSH
T1EC42D7166A34997BCCCBD209FA55BF53E6F54473D2940E44AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 570baa62eb7a8b50704c4cd72988ba0a4ac4e11698f1464b3b9852520f70a000
MD5 b1736f417f9991f658a970272573e5bf
SHA1 1e60217b438acfa5bc7c5843760d2d75e300dfde
SHA512 58802faa087ddb3e33a16649ec842e58f098b8d5486e08e5820d02ea9d963c5bc689cb97cd3390e859227021c01050c87b825c4477e2ef1358fd27109de6893a
SSDEEP 192:sxZNR7R9yM/jK1Ml8UQlkEG/fdsOC2IsIdpHTyHW6+WNGY9IUiHW9gIg5NJ:sxZDfqux/fdsOCDmHbG7h
TLSH
T19C52D6166A349977CCDBD209FA51BF53E6F444B392900E44AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8b073999008cd546671ffaa0dc99919df6e81c6324e8ea082839c93d73cf7d7b
MD5 647b4f0294b9861a963e0e9002c1eb9b
SHA1 bcc087acc14dcbcb64cb9bf9c41805a209235f5f
SHA512 cb18762e42990833fc616c672f3cd523751185d0886ae6540dcc0b75ae517ce9039860e66f937a6154edb1b84f60a8a07c426b471a5fbdc5841b56a1ab55f495
SSDEEP 768:FOcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNiroPng65:FOcv21wWvu+Z+u1jaeFLeRN5/p
TLSH
T1E5D20B2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ff1fc852761261cc5510affe0bfd5e9297f08651c0df29a1092aeffaacb05af9
MD5 dda0106a4353443ced990398839ff250
SHA1 03f9f2eb7c96bd8092c8d284d7f286438e9727a8
SHA512 65045d6082869ca3f01ad0e53eb7b6f921ef3ca07e1286b609950b8460fab82f6b32d6b17c2322049111f206e4654b0daf9c07f4f8f8b4f9b254588bfd402fe5
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWKm8KjaO2X6KcwQ:mTkrVb
TLSH
T158917512B07E12523A3D680C925586358EC2F19735E8A47BBB6885E50F77E229CFCDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59c2f4cf-5214-43eb-8fe9-d671b8392bee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\59c2f4cf-5214-43eb-8fe9-d671b8392bee.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 88b54c674707770b056bfc809eafdc3a1421db583dfa983bd66259cb4cb75e2b
MD5 500e5c8bd4cfca4ab15345e1acdc0892
SHA1 bc21e5c4da8feb587a5b628717c12d7e847aa767
SHA512 61a4b33fe38933a0c94f4f4f7e6c6b906b985ad978dbc53db16debe70b7459b24b30a7ab6e4aec46d9650ea9fbe93ba167dae85e56e66e96765416dce1ca015e
SSDEEP 384:mZcIhsNf0uld5zijt0e+CBd0esh4AOObjI9G6w7h/:0h6ljk/Jxshp29Mh/
TLSH
T13F928D36AC381D768AA7A512F48736135FF8D177E7D52B40A1EDAF0C06EB9AC130581A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8b665589b9790cab99c77151cc503f6a4b560ebcf8a8bacc6e883b5f7679636f
MD5 852e897b4a3862fccf1091c16bf2b8db
SHA1 79c60633495db7837f09a9b425c99d7fbfc8096a
SHA512 d52ec66de4c91b6a7034667474c18445815e9f9f32b0106f515e28912233a11bacbf97cf31a9dfb72d22007bf91e7896c14eef5f83589faf5867709e198d8604
SSDEEP 384:giFiZcIbzsNB8TUNTUlIlFuld5zijd0e+CBd0ese4AOObjI9G6w7h/:7FQPEwgOlj8/Jxsep29Mh/
TLSH
T1F4D229F258E7493ADA6E5B03B77E2D124EBCC063F6956A40B3D89A0CCD961BFC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c71b9fed416f6a19f0bff38b224bc08e48f26c211ae08b2dc13a3025ca44129c
MD5 e3ea33abf233a329564d60f628cffdce
SHA1 5e01b9539065037606170138a6d2299747ce11de
SHA512 27be5ee77d31d94eb421ca453f1e1fc4f9aa9867e15025744d69b451ab12308339ecc94372954170ab0ca517963f351df6400895494003f3ec7f847e6674ac0f
SSDEEP 192:JONa6v+YLNQmiUySwKZh+CGD+FdeP9ospus12AU6:JONa6vz/DZh+CBd0esJwAU6
TLSH
T10B02EA39AD381C6B9FF2AE45F48736175FA81177E9922F41D9E81F0C01D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4c0c0bd9b9777a62d5d2ef4c324e154f6d7c48630cfd2ebb44d2441469693e51
MD5 74e902969cdfc4c9dabd9ddb7bfbb1ec
SHA1 29fc16a2fd432064237823168bf50fe72d1b8613
SHA512 76684bc55538cd7802d37f8bd058cb1f6c495156fb82509982976d6c60011ecbb539bb10151f37de3e2c908458f9fce3c80a5aebbd1889e55cf7f4e557d8ec83
SSDEEP 384:LZcIhsNfFuld5zijt0e+CBd0esh4AOObjI9G6w7h/:ThPljk/Jxshp29Mh/
TLSH
T1A6928D36AC381D768AA7A512F48736135FF8D177D7D92F40A1ECAF0C06EB9AC130581A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a696f757c3816ddbc1f45bbda5d6e99f251af93fe7584b63b3deaf48f62e453c
MD5 4d44a20d33d873636be20889f1e11006
SHA1 30c444d9c25c70c5ba8cf974594a3291b36a251e
SHA512 c8c5e91f3a06c9212b016d8a5bb558cd8f79a86ce2add0a965ba2c089366db395b64087dcc92de95cab53ca4764641d1840bd0c5ee101f0a9435286d714162d8
SSDEEP 192:AONC6v+YLVQmiUySIKUh+CGD+FdeP9osNOeBRCHIq6AU6:AONC6vz3DUh+CBd0esY4AU6
TLSH
T1AE121A36AC786C6B5FE2A541F48735135EA55177EE863F80E5EC2F0C01EF69C230691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6eb93c5c-6ac4-41dd-987a-27f5886e22f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6eb93c5c-6ac4-41dd-987a-27f5886e22f1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b121c9f983be36acf532f4a2fa2efa0b23a071c40eb815bf87c472163801e91e
MD5 eb5a427ef7bb1ff39da07c9810207830
SHA1 758777d78fb429e481bd4b3ede6138a6516afbca
SHA512 1c88204211a33059b4f569383b14645559f76a946d3b75c5bb0269c65db647b4361664f8f88a1d2500ba8760a1b3e9603692d745ecbc5ee68249bc92aaf0dcee
TLSH
T11A412748AAFA1148B3B72F569FF7A8AD447E78732E0AD45E10110D4F0A67B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download