518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区备用网址.html
Size 1.3MB
Sample260728-pp92sahn51
SHA256 518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9
MD5 77d8030e6ab130d612e2fbbe896dbd33
SHA1 94bcd98aac314e2e3088515e9ecc82de9d040475
SHA512 fc30b317253da5acdea37b39ae444e15a86284fc260459aec5d7081102aa4b607424558686eaeb58a71b8474f49184353cf7b226aeea30d04c92c25e4db49707
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++P:Eav2F+YhwIT
TLSH
T10D550051D81A40B271CE05A23EAFE25E263D7A1B9FCD1B494D2737EDE07260DB09CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297154990448350"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{22DA2D9F-6F1F-4010-9E6F-ECD2A07F72FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 5408	1236	msedge.exe	88
PID 1236 wrote to memory of 4108	1236	msedge.exe	90
PID 1236 wrote to memory of 2864	1236	msedge.exe	91
PID 1236 wrote to memory of 2864	1236	msedge.exe	91
PID 1236 wrote to memory of 2864	1236	msedge.exe	91
PID 1236 wrote to memory of 2560	1236	msedge.exe	92
PID 1236 wrote to memory of 2560	1236	msedge.exe	92
PID 1236 wrote to memory of 1268	1236	msedge.exe	94
PID 1236 wrote to memory of 1268	1236	msedge.exe	94
PID 1236 wrote to memory of 620	1236	msedge.exe	95
PID 1236 wrote to memory of 1268	1236	msedge.exe	94
PID 1236 wrote to memory of 620	1236	msedge.exe	95
PID 1236 wrote to memory of 620	1236	msedge.exe	95
PID 1236 wrote to memory of 4948	1236	msedge.exe	96
PID 1236 wrote to memory of 4948	1236	msedge.exe	96
PID 1236 wrote to memory of 4948	1236	msedge.exe	96
PID 1236 wrote to memory of 6140	1236	msedge.exe	97
PID 1236 wrote to memory of 6140	1236	msedge.exe	97
PID 1236 wrote to memory of 6140	1236	msedge.exe	97
PID 1236 wrote to memory of 3016	1236	msedge.exe	99
PID 1236 wrote to memory of 3016	1236	msedge.exe	99
PID 1236 wrote to memory of 3016	1236	msedge.exe	99
PID 1236 wrote to memory of 1116	1236	msedge.exe	100
PID 1236 wrote to memory of 1116	1236	msedge.exe	100
PID 1236 wrote to memory of 5808	1236	msedge.exe	101
PID 1236 wrote to memory of 5808	1236	msedge.exe	101
PID 1236 wrote to memory of 5016	1236	msedge.exe	103
PID 1236 wrote to memory of 1940	1236	msedge.exe	105
PID 1236 wrote to memory of 1940	1236	msedge.exe	105
PID 1236 wrote to memory of 1940	1236	msedge.exe	105
PID 1236 wrote to memory of 3920	1236	msedge.exe	108
PID 1236 wrote to memory of 2764	1236	msedge.exe	109
PID 1236 wrote to memory of 1616	1236	msedge.exe	110
PID 1236 wrote to memory of 5084	1236	msedge.exe	111
PID 1236 wrote to memory of 5084	1236	msedge.exe	111
PID 1236 wrote to memory of 2972	1236	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区备用网址.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x280,0x7ffa5ae5c188,0x7ffa5ae5c194,0x7ffa5ae5c1a0
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2100,i,6377978975496920442,2549048723307779825,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,14325213700111983967,9636425505060075027,262144 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2464,i,7950197603543529776,2396322258537173145,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,1940765859972263989,14270258362991529537,2097152 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,11581213572807312130,13271290944424928347,2097152 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,7583035992443370,15002584364176034655,2097152 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,3547078975184123998,1999681712041372215,2097152 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5400,i,6871437732912116056,16145948890104050795,2097152 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5512,i,7447452040342024156,1583778064676845312,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5516,i,6739803609561853892,13011097973459580052,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5928,i,12963557485572010400,5234001248834032159,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5928,i,12963557485572010400,5234001248834032159,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3712,i,15967365624113257686,10670737089693630817,2097152 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5264,i,895587732141514395,14090729934902754955,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5228,i,6990953911675606741,707937804809558874,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5232,i,18196960569159951727,4407404873917554389,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5148,i,4359005097866909213,13223911232612357564,524288 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,4364382560301109702,1973792474456866441,262144 --field-trial-handle=2760,i,15039402266637984579,5086192806902249016,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 db6b3ee14fe9e8b12f241a826aaea74fae6a74c38e5af11ddf917f92faf63319
MD5 8e54924c6f1df38c8686a8706a476fd3
SHA1 dd5844c99acd30b83d0c992250a015ef573dd377
SHA512 77b14e187e41617573afd76e3ae29577680d7f610a8e7d399c93a0a20646ec61671c8024649aa5b6d25aa02f32b84afcde7894d2640000052c078e7dde69ae8a
TLSH
T17951811D133A3DDCE3A00AF66EE1D6643BFD889E02076E1062542DFCDA42F3881D20A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ed06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ed06.TMP
Size 2KB
SHA256 f4623bddb87b0cf4cf43a022901e95bd03032fd1d847e6611a49aa6943cc9697
MD5 ab312b18bdf13b866645dff4bb82d679
SHA1 9420058b4724ddbdaf5275ae0d3e59e0a480868e
SHA512 f0dabdf544ff7f204367619a9f85c7822c9f2bb0874d78eb65af01ba46a3d6c4b29c6e59e89bef3b66dc6a6251552074a7e3c50b7f603320890a5b03e01dac17
TLSH
T15F51505D133A3DDCE3A406F15EE1D6643BFD889E02072E1062542DFCDA46F3851D21A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 91f843902d35afa9939c4b647adb047288bb4c155fc01255ae12c965cf056f37
MD5 b665aa3b055f7117051cbb42d6c3cb94
SHA1 7ee0caa2f4ac4474a3991e2a754a68ada972a890
SHA512 279e7c0e87eec7b346445316e92d3e65ccd5add8fda10f4114790ad618e3287e8bd48471975412b2298321fbba5c7616766bde15a0cef912413d359c4785fb70
TLSH
T1C251CAF7C3E4963D890196F4AA187F2BCE1C0955832C7C2AC9E4AF1B93E2471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b46478262f0d88a5487c91c137c15190c202c52ab42a90d4b1f8c37031b7ed7b
MD5 d1f9d8f74651103516bd80b9836b7d7c
SHA1 b867117b1bd8a479b455be5c0394d2d7ba362ec9
SHA512 e010dc957dc219f390eff7a6746ee2fc642334251a4ccbd0f890e4d233bd0e5b4cf5a6eb77b2aba37ed70807c112c8f7a8f5d2f40dd14d19044fc25aa138f2df
SSDEEP 192:sxRjRnb6/fpsE7OprQ5kzoA8p4ZK/g6+WNIYn8SHzWGUIgDOJ:sxRjt6/fpsE7OaF/5IT4qG
TLSH
T15142B61A6968AD7B4CCBD21DBB55BF53E2F95072A1D01E48A6FC8B0C04E77CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7c85bbf1d83b9a1ef7d16f78d1e6399bff2a45407ed98c4f554c2e2ac16bf4c8
MD5 bc7ba146d9c92b5c19b72d77f929d375
SHA1 96350b6817a4b91b4a7ee0da867f12e1447563f9
SHA512 85372c893ee063af1e7c6227a19fa13d40d9e32fb699a410f9cdeea59530bed4457e11f9a618e02b73752569b244d2a5eb9283bcd072f37600676f2681ca16d1
SSDEEP 192:sxRjRnb6/fpsE71prQ5kzoA8p4ZK/g6+WNIYn83HzWGUIgDsJ:sxRjt6/fpsE71aF/5ITXqc
TLSH
T1B342B61A6A68A97B4CCBD21DBB55BF53D2F95032A1D41E48B6FC9A1C04E77CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 472a91e5578f3dca41da87cc9c27d9e9b16b6f15dc96d363e1fbd73a87c63b6e
MD5 56e2f314caca5a93f74b3dd05d8a4fde
SHA1 f886dbdd01688cba5ecae516d08fa90eaa9aa414
SHA512 2f0a62079e44e28c594deca89cca4439c21b74a2f6ec764780f6e1122b5575da40433bfc294c7393b05adc83141c87bca0794805dcec557759c08e01348603ed
SSDEEP 192:sxR4Rnb6/fpsM71prQ5kzoA8p4ZK/g6+WNIYn83HzWGUIgIJ:sxR4t6/fpsM71aF/5ITXqs
TLSH
T16832B71A6A68A97B4CCBD21DBA15BF53D2F95032A1D41E48B6FC8A0C04E77CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7b8784b387b5b05293073a43ef1b7e71e2ed51ba8480a1a4b97431b88f349621
MD5 8e98f8e8a2020085d00176b86c759c68
SHA1 bdd4235ecb156f04df559959564b6b89ef1beada
SHA512 1627024ce682214eee9705a2acc33c2538c0d64d3ac77b9de61079d079c47b490995e5fc58c1896b9ccaa4a272c707ee38185e2abf4fb12bd41d75ae7c8d41e6
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPDrohMn:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Vw
TLSH
T157B2EC3B604DCB7E5F800A9DEC19AFDB6D9802C79A948D4447FE950C03C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 22be243f3e6a5604f7d89778d390e9c7f64d95697088c0ce576e54f3689362f1
MD5 ac02f219475fdf587d9bf19c4a999f0b
SHA1 d8ab987cb9aff3ac465c27b564a8b24efe62b466
SHA512 c5a4bf0aff26073807f24fce04467964011152512c3b32d9ad123faa5d7bb385d2d68c60083f6c98fd94b7d9a438617723d863b70b0511120ee6e878d55e5cb8
SSDEEP 96:KRv4dZvtNhW528gBhK4Igvhc3f+BtiHKoKZKsK4KqK2K6KgWKeKDKzgKgKgK4K1I:Cv4dZvtNs529BLIgvO3f+BtiHN6zn9Xh
TLSH
T11AC1F410323B0644387DB60585789D6AC6D2B4B6B55AA42F37E843760F67E438DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a72ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a72ef.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 52144c7f79698e8391558ec81ec4e82321318d7e1eb54d679c7f4f640a85208e
MD5 c17e0e0ba694fb8196081a768a2b54ea
SHA1 99bfec1a35f68ecdbe6c99cdb4791a37495f27c6
SHA512 ff36547c794b3a9987ba92369e3d3b0862ea5cc9e644ad88bd605be52265261e1708a00c4d84acdfa7ef617d206f99f424e345ac62e80cfdb39621ac9f123a3c
SSDEEP 384:hZcIR38NNS4lZ4uuAJDZNfNoXOVSUU0XtdXqFYETRzcoXfK86sfxEZxxsIj4lBAc:pR3YCyDZIO0crKNzc4ReyIsPAb9M3
TLSH
T121F2BF36FC688DA7ACEAA745B50732137DF5912BC2C82E8495DDAF0C0A075AD431B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 851568edcfaa6f2242ee0f69c3642252e7bf164d9ebd25563e0d5e9b2355c401
MD5 09d2a74459e9ce70f63c8b8aba06d097
SHA1 c6ffc03a76b94f064ceaf423aa2859ce6743c74f
SHA512 275d66aaffe448b02d0d3e195874d4612f42b9eed0e51c7465e00d2805786546a03efd6ec6a64a00fe094abf767260bf44b4988fa0d3d37cc8a2edc76c869ef4
SSDEEP 768:jFQt3Uwg34yDZIO0criNzc4ReyIsPAb9M3:Gt3mQtc44bsIb+3
TLSH
T1F11338F298D78976ECAD9743A73E2D026DBDC167B1846994B3D95A0CCD061BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 34393438aafb10fcc15909db45e035682ed4c83113f8e8356e6a5bdd56524328
MD5 4a594c64a4187dfb1ff887606e64b027
SHA1 2055f882a151c5176125f2775b9c020f001dfb7d
SHA512 8f23254ef5c1612eaab1fb227c377322ee78e050f7f60451cd11697d93eb3d4b1139bf098863e52712d9cd72660409fb8200bb42b298b34bf92d414ce238e0e5
SSDEEP 384:tZcIR38NNX4l0NkuuAJDZNfNoXOVSUU0XtdXqFYETRzcoXfK86sfxEZxxsIj4lBF:1R3l02yDZIO0crKNzc4ReyIsPAb9M3
TLSH
T1D9F2BF36FC68CDA7ACEAA746B50736137DF5912BC2C82E8495DDAF0C0A075AD431B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 17126fb88c907be7400ec15e35cbe26a9f0dabbece8baa34403be80c225b17ad
MD5 c1d7b8f3c6b79355d9e2b31122a2b288
SHA1 2fddbb20fd437361eff1aaacf1d6b8ab62f88c6a
SHA512 7bcf0caad080b37e3f1cf6a16a82627dc3e18d27df1acf0cc9d354d2089920e773a8c0ca24d0d243fcdab0b4f5d1f4f9742c3a51c6b863c55d75e9b5d1d4666f
SSDEEP 768:6rv+4UNbds34VDZIO0cdNzc4ReyIsXCeVH1S5D:6bsbS3Utc44bsSEH1Y
TLSH
T1AA03CF36E8688977ACF6A686B50775533EF8512BC2C81ED4C5DE6F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b0b7608-73ef-4f5d-8c5b-4774214bb7f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b0b7608-73ef-4f5d-8c5b-4774214bb7f6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download