8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/__扫码.浏览&下载 _1024社区.html
Size 1.3MB
Sample260728-pp92sahn51
SHA256 8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333
MD5 15280afe83c4f878e148e21115befc55
SHA1 0b14258bda8d938b9912fadab12603b001ce801b
SHA512 1706e300c677e64e4c79936184c4f95a0e4d35222e197a119ff653b61f72716a91b15fb9c43e7ba02adfcba1e33f40d27285875e003f03279cda0be21a1fcf9a
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++J:EahIuyTFCseZ13FSr++YGqL/IT
TLSH
T14F550055D51A00A275CE056A3EEEE25E227C3A1B9FCD974D4D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297154975628669"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{D757471F-2126-4B56-BDA3-53B1C2F37C27}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3300	3056	msedge.exe	87
PID 3056 wrote to memory of 572	3056	msedge.exe	90
PID 3056 wrote to memory of 1440	3056	msedge.exe	91
PID 3056 wrote to memory of 572	3056	msedge.exe	90
PID 3056 wrote to memory of 572	3056	msedge.exe	90
PID 3056 wrote to memory of 4976	3056	msedge.exe	92
PID 3056 wrote to memory of 4976	3056	msedge.exe	92
PID 3056 wrote to memory of 4264	3056	msedge.exe	94
PID 3056 wrote to memory of 4264	3056	msedge.exe	94
PID 3056 wrote to memory of 1344	3056	msedge.exe	93
PID 3056 wrote to memory of 4264	3056	msedge.exe	94
PID 3056 wrote to memory of 1344	3056	msedge.exe	93
PID 3056 wrote to memory of 1344	3056	msedge.exe	93
PID 3056 wrote to memory of 4300	3056	msedge.exe	95
PID 3056 wrote to memory of 4300	3056	msedge.exe	95
PID 3056 wrote to memory of 4300	3056	msedge.exe	95
PID 3056 wrote to memory of 4700	3056	msedge.exe	96
PID 3056 wrote to memory of 4700	3056	msedge.exe	96
PID 3056 wrote to memory of 4700	3056	msedge.exe	96
PID 3056 wrote to memory of 5888	3056	msedge.exe	98
PID 3056 wrote to memory of 5888	3056	msedge.exe	98
PID 3056 wrote to memory of 5888	3056	msedge.exe	98
PID 3056 wrote to memory of 1400	3056	msedge.exe	100
PID 3056 wrote to memory of 1400	3056	msedge.exe	100
PID 3056 wrote to memory of 2596	3056	msedge.exe	99
PID 3056 wrote to memory of 2596	3056	msedge.exe	99
PID 3056 wrote to memory of 2736	3056	msedge.exe	102
PID 3056 wrote to memory of 1524	3056	msedge.exe	103
PID 3056 wrote to memory of 1524	3056	msedge.exe	103
PID 3056 wrote to memory of 1524	3056	msedge.exe	103
PID 3056 wrote to memory of 2808	3056	msedge.exe	107
PID 3056 wrote to memory of 1096	3056	msedge.exe	108
PID 3056 wrote to memory of 4388	3056	msedge.exe	109
PID 3056 wrote to memory of 2096	3056	msedge.exe	110
PID 3056 wrote to memory of 2096	3056	msedge.exe	110
PID 3056 wrote to memory of 4864	3056	msedge.exe	112
PID 3056 wrote to memory of 4864	3056	msedge.exe	112
PID 3056 wrote to memory of 1456	3056	msedge.exe	113
PID 3056 wrote to memory of 1456	3056	msedge.exe	113
PID 3056 wrote to memory of 4780	3056	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\__扫码.浏览&下载 _1024社区.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x29c,0x7ffebc87c188,0x7ffebc87c194,0x7ffebc87c1a0
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,11732835871504104114,9201489853034564503,262144 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,15112980164724559248,18402869006963040102,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,3680612156578841973,5187078790591817972,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,15449783471773094972,16067139302629951375,2097152 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,906744169989321451,8043358572373535970,2097152 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,13224934114949784656,12707711001359644765,2097152 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,1259301571509444314,2038398644830399627,2097152 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5392,i,15740903664285673619,9133074560074432742,2097152 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,11939141090887596450,12255210079117251692,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,6045961488595647222,15212601715990493625,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2587169587864740262,15004530409923155243,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2587169587864740262,15004530409923155243,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5264,i,12389865803250759750,7263825990414602165,2097152 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1236,i,4112409924561206062,15627908691509573310,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,6024769480242567260,10591139545167441399,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1092,i,16244407550055088481,17542183834704638060,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4033680587545006463,3331130193880479889,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,4376080352659902415,9090088269893571625,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,15787811325214533861,4417845482776738984,524288 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1356,i,5043161037807578045,9926718684099760234,262144 --field-trial-handle=2304,i,8673543508232589539,2019048919067323116,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 57d70637ce97b5d874e34b6ecb6e17e35f2fa3224dd17cb97ddbbab29153b628
MD5 9c4b6b6a6c5f1f20e688c5a5d5ae737e
SHA1 270713679eeba7cfacf568e0e350ed72281c7291
SHA512 b1ba494229d97d1faa927bde89098a67ee591014f9839d6a2e78f053c2a206eb2f9ed0f891cfce6e6fec331ae44b63cdc8509efd75d67ba76978d6f7123b52b2
TLSH
T1F5E0268866DCC3AFA6007A47416C630CC3C13A1F92C8E9CE6B0888947082C84B3E7A90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 538c9cca052377bba00bc5d71828701e7b870efd9e874f720c4852b7a1957fa3
MD5 92250e6c3078d90ffb6265b5dce9ffb4
SHA1 7fa7ebb82590a5b9de36be29585e63de4c196d7c
SHA512 c79b5a3b37578f3f14b4e6411c79c781a8da7eecae01f1acc60c84f172b4fa4d33c16e3baa624b41f8460674f90a66a7df8bb2daf41f1a9a05a4e913a6bd146c
TLSH
T1D4518497B36E29C1DBB596F5DCDD944432F1C8A822236F01826CAC7C5E06F0A6DD207B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3fba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3fba.TMP
Size 2KB
SHA256 b7a5d700275f1f21dc673ac57feff012a15c000a9c9617d1849856e260f25e57
MD5 13b1ecab0d7eabe912473a669463df27
SHA1 39056ee7c95ea34a1ac5b4eb7f803fa78aa14e14
SHA512 bbe39d67ea8f87665130c26b8da61f2c737af913f6bb80591f4e339288741759d8b146fe9d193c0b584526aff043c3b19fb961da9f07c91ae6a762a012cd3ee7
TLSH
T1A2517497B36E28C1D7B686F1DCED944432F5C86822236F01855CAC7D5E0AF0A6DD203B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 36e4717ce9c46303d6ce1a8959df0474bde41951abd90e1ce625eeeb62fd7df2
MD5 cf5b8a96879a989b631023280eef0602
SHA1 e7a13294a5001126999aa8a4f5218e364341f7e9
SHA512 2b4258194bc8820d0255fc47dc0ed5507714848b54ddbfaf19a90f5075f84f7fa6ee55d444ba632487698c00ad3dd3784d9cd150023cf92f4074003e7ec39d44
TLSH
T1DC51BBF3C7F8867D991156F4AA182F2BCE1D0A15832C3D1AC9E4AF1B97E2471E20195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d1110a21e12757f2f097f9d8e4fddd416dd433aed7eb9e6d217b027a7c97cac1
MD5 b05d0f61bf8ffa39cbdcd6bd3f8d3f06
SHA1 b0bf2f8f741ebcd3fb882dff794fada26b98c7fe
SHA512 9eb4ce8b9a234d5ee014f12e8111343560f44e90a17df5475115abfb0d830fe0dd8f2683751903a19ec96763b320e9c060b20825c14d9161bd933c0299e5ecbd
SSDEEP 192:sxRXbRJb2/f+srIwGxzoA8p43F/g6+WNIYoUCY8GUIgDmJ:sxRLf2/f+srIpsk/5IzD+
TLSH
T14A42B61A6928997B5CCBE21DBB56BF53E2F95472A1D02E48A6FC870C04E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 acf44dc4a1c433a1869a0f09163424d2e3a3607411572536e8f8a76d76e4c6dd
MD5 6bb0a1a2ab431b92d47a1a38c08277d8
SHA1 8efea5f4d491fb26ac9b4dc2354451f516378456
SHA512 668046316b8116471fbac1e2959e7d009b09728d265d4646e5c42b3bddfa4456506b869a4f2fad624b62456cbe5bbe51b4bbeac2de254b72389ce1b48ce942c2
SSDEEP 192:sxRXbRJb2/f+sr5wGxzoA8p43F/g6+WNIYoXCY8GUIgD0J:sxRLf2/f+sr5psk/5IyDk
TLSH
T15832B61A6928997B4CCBE21DBB66BF53D2F91472A1D42E48A6FC871C04E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ebfa8b9354cda719e992af7057ff63b5cb32046d0f79a535a88349c8f21bf24d
MD5 a6ef8f87c3b304a8bc91d69226b57eb6
SHA1 d87aa80cfd407b24c6568e0e76dbbbddc396a6ff
SHA512 5ab07564855f9d325c5d1108f2908dab8d69375abd803cf73e820aa30b560f46fed747df0cd512fc82f2d51523ae62babf954d1749a77e8ec39cce8334cfec28
SSDEEP 192:sxRXwRJb2/f+s15wGxzoA8p43F/g6+WNIYoXCY8GUIgIJ:sxRgf2/f+s15psk/5IyDs
TLSH
T11F32B61A6928997B4CCBE21DBB66BF53D2F91472A1D42E48A6FC871C04E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 8177ae131cbe7465bcd12d45d2b47faf288a4183574a4a858c526aee8818785b
MD5 b488d50d08c312565814cc5579da8ede
SHA1 0c817999df803276041acd4779479def27c33f5c
SHA512 8be8711ae34d29860520be7fa3a05e5c433806f180717a234b91cabc1f005df15ff1f97bbba35ebea6a67c8b3164852602f9ffee364a148a08e9ec60d0963f3d
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXwro98U:j26H0RWgs2f028F1+UoAYDCx9Tuqh0Vo
TLSH
T13FB2EC2B640DCBBE9F800A9DDC19AFDB6D9802C797588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eeac6e4f1381b0167012fe3d8750fa4665f7b6dace9c91368e618f17c3b12af0
MD5 68cb21840bdfa0ebd4ebf957a125eb91
SHA1 55a41e504297a7ce99c0b8e092f9011dc413ad63
SHA512 98b32c648055715c90b305e23f0310646a73e782218f8dcd7cdb228ba6503e7deebd4138ec6183f1e49e9de97b3f782aedaa3fcbb62b3d0bc3b03e8aaf0412d0
SSDEEP 768:iks3536//TBOWJLt16TONXyer1IRCzni9Ab9MM:iks3UCTSIqnrb+M
TLSH
T13CF2C036E8949E734CE6E396B1477703BEF85067C6C84B44AAEE6F0D059796D030B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dd56b118af43730d65a7c5893b41dda54b003571c56a697fdfdcebe44cc594ad
MD5 bdcbb23abc36064b12ad1ff97a767242
SHA1 1845c4d70e81228f63fb9c19b390c31a23f6fdf2
SHA512 82a4c942c12eef0182ae3fb9d95bd5459c38eb5623e8af49267c0b8def4779d7bbe60147410bb91b769240a1ee79eb251916d993374ff9b3bef1b0d94746daed
SSDEEP 768:eIrv+4UNbdH38vi//TBOWJLt16AONXyer1IRCzni9Ab9M+:eIbsbh3DCASIqnrb++
TLSH
T13713C032F4989E734DE2A296B14776437FF81097C6C40794E9DA2F4D059B8AE130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 13e5b68830bc3917187795a8e1d264137073043b3b50d8257f39e890daacdf25
MD5 974091c29e2e46dad94c6e40e5dc125e
SHA1 e94bf1d77948921077f0b0d137340d7a4520bf9b
SHA512 5c2b2facd45d8ae5ae798288fccdb39dc9130da24929e2431e3f9cc10afaa3e2cc4cc218af6f44e0396673a91064e955e532b067f590e1f77048121b2383074f
SSDEEP 768:aNo353K//TBOWJLt16AONXyer1IRCzni9Ab9MM:aNo3ICASIqnrb+M
TLSH
T1AD1359F5A4D79A73C89D9393737E2E026EBCD067B2840640B7E95A0DCD5653FC30A406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b250ece8ca6021baf827cc929fc9f3e521207ede47dcf31f4b8b3739ee625856
MD5 b174d0df1db8f5c5994f9cbc337eec6e
SHA1 120fce5da62f66921fa7b5532b9294ae6a3cdd0f
SHA512 5577602d8927a11e5614dd5314f92b43dbde770f7d90c0998bb9c377109f915bd267f1aa95c83be3bef7eb6e18dda383ee9adca55ce70fc86e8f3181f4179f6e
SSDEEP 768:eks3836//TBOWJLt16TONXyer1IRCzni9Ab9MM:eks3jCTSIqnrb+M
TLSH
T125F2C036E8949E734CE6E396B1477703BEF85067C6C84B44AAEE6F0D059796D030F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2d548b1df8390d4dc6bbe94c804e7edde13f0d54e9c6bf2cb3134ac388abca54
MD5 4d66f9b51380d7b92bde2f7ad1cfae70
SHA1 7b9e17357a21ce75334e10beb825d7c43c67c5cc
SHA512 354ea0e72fb3e02f2619b0871de009d8919722b3a29c0b7116976feb2c213474e371e208d7b72f81c65a20a33ff0e450f996f6312228f2261f96da313b7d3bb1
SSDEEP 768:hrv+4UNbdz3AI/TBOWJLtJONXyer1IRCzniBleVH1SK7:hbsbV3zzSIqn+EH1l
TLSH
T1F903CF36A4A89E338DE2A3D6B14773037FB86057C6840790E9EE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3080fc5-be83-4f95-ab9b-81a66f52aadd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e3080fc5-be83-4f95-ab9b-81a66f52aadd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download