8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/__扫码.浏览&下载 _1024社区.html
Size 1.3MB
Sample260730-pterfaan8z
SHA256 8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333
MD5 15280afe83c4f878e148e21115befc55
SHA1 0b14258bda8d938b9912fadab12603b001ce801b
SHA512 1706e300c677e64e4c79936184c4f95a0e4d35222e197a119ff653b61f72716a91b15fb9c43e7ba02adfcba1e33f40d27285875e003f03279cda0be21a1fcf9a
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++J:EahIuyTFCseZ13FSr++YGqL/IT
TLSH
T14F550055D51A00A275CE056A3EEEE25E227C3A1B9FCD974D4D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2148	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298889289022209"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{E7D604B5-6A76-44B3-B459-9527E3CF285F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4608	2204	msedge.exe	84
PID 2204 wrote to memory of 2148	2204	msedge.exe	85
PID 2204 wrote to memory of 5604	2204	msedge.exe	86
PID 2204 wrote to memory of 5604	2204	msedge.exe	86
PID 2204 wrote to memory of 5604	2204	msedge.exe	86
PID 2204 wrote to memory of 4372	2204	msedge.exe	87
PID 2204 wrote to memory of 4372	2204	msedge.exe	87
PID 2204 wrote to memory of 4296	2204	msedge.exe	88
PID 2204 wrote to memory of 6076	2204	msedge.exe	89
PID 2204 wrote to memory of 4296	2204	msedge.exe	88
PID 2204 wrote to memory of 4296	2204	msedge.exe	88
PID 2204 wrote to memory of 6076	2204	msedge.exe	89
PID 2204 wrote to memory of 6076	2204	msedge.exe	89
PID 2204 wrote to memory of 3832	2204	msedge.exe	93
PID 2204 wrote to memory of 3832	2204	msedge.exe	93
PID 2204 wrote to memory of 3832	2204	msedge.exe	93
PID 2204 wrote to memory of 3332	2204	msedge.exe	94
PID 2204 wrote to memory of 3332	2204	msedge.exe	94
PID 2204 wrote to memory of 3332	2204	msedge.exe	94
PID 2204 wrote to memory of 3312	2204	msedge.exe	97
PID 2204 wrote to memory of 3144	2204	msedge.exe	98
PID 2204 wrote to memory of 3312	2204	msedge.exe	97
PID 2204 wrote to memory of 3144	2204	msedge.exe	98
PID 2204 wrote to memory of 2056	2204	msedge.exe	100
PID 2204 wrote to memory of 4636	2204	msedge.exe	107
PID 2204 wrote to memory of 4248	2204	msedge.exe	108
PID 2204 wrote to memory of 5788	2204	msedge.exe	109
PID 2204 wrote to memory of 3876	2204	msedge.exe	111
PID 2204 wrote to memory of 3876	2204	msedge.exe	111
PID 2204 wrote to memory of 5184	2204	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\__扫码.浏览&下载 _1024社区.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff85254c188,0x7ff85254c194,0x7ff85254c1a0
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,1555398316921449878,15964514686515747414,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6714061076049671699,8945147001540578300,262144 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,6151457456559799834,6678889299516198799,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16113268800640454035,14300360557247769480,2097152 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,6762085964517808683,10707520021121611113,2097152 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,9946509033559692667,5374971575096123105,2097152 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3464,i,7326052330126325276,18047383331105884306,2097152 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,457176908528232203,2493429747276621387,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,5893354716687598311,446637338858073236,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,12906166915991123513,13078189382282557933,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,12906166915991123513,13078189382282557933,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16558869107271068032,9207096255583895441,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1914575921189270125,4828776553202948379,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,4654287592850730917,6332298357969639681,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2712,i,17595512800214950884,7320158714757033475,524288 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5864,i,4081166309520406723,10625044280375892925,262144 --field-trial-handle=2616,i,14215728399787483889,14639550860164939653,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7608d4b0a5faf20cb92d7a3f9029a6645abb7311f46c77642163fbabfcbdc12d
MD5 ef7cdf5ecc11fc93e5db3961fa7d2295
SHA1 9ac05d170a502d27c87ee88a0216b4964ff4cb59
SHA512 35ef4f6fce389a89ef9fbdb59c45682e16966aac97eac31045908918e32a1ac0b368386420ba8a6c9d33f4510e62df4403ce076c9a6f742d9abc95f20e63eed4
TLSH
T14AE02BA6C925EC370AFD4B58A0098656E71113172691895F3A3D82088FB063645C585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c04ec7187b1e77ae70b82edd9c2ed8f6359775a831ef56f5f2eef8d422c514e
MD5 26b75ded7d55da5df5d652fd82ad6eee
SHA1 5ecde8e2ed01cefc15e81db254678641c084a8f3
SHA512 8538841aa2429d3e6b945fd951f1356c70d218541b3b11752a68669294770fa8e3e674b3e72122906d1d212227f46da7b6568827818ad85b3d6d8aa0bdd5ae21
TLSH
T171611C36F902D878EB23433195E07E14B9B482D9FFEB5EF219A444757CC6B14436D298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1eee673a-8119-408f-b17d-e7fe90e2b8b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1eee673a-8119-408f-b17d-e7fe90e2b8b9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 05b654dbf09c422b1e20d0ae57f3a3988d46c4fa9f6d57dd66162b9fa18578f7
MD5 6864b7e56a5006da36a052409a986edc
SHA1 2be74d348438b882dfd417d3e4db8c00b1111c94
SHA512 db0197a994cfddc95a4f82b0f787e3c594f2968a249c6a74106d5ebf610729049fefce182b8dec9ed3f3f4a353eba24bfe50a4548ac69492adf032c3c5cf6d57
TLSH
T1F241D2F783F4856D8A0195F0AA187E2FCE5D0550832C3C9AC5E4AF1B93E3871E10595B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d6762245ecbafd0971899b8403c54f06887c2f7986617046079078de48de3276
MD5 69f0a2673d419b8e18b9e848a28ecfaa
SHA1 1f7d3b319bdb60d0fbb262c59480b6f540de5f3b
SHA512 ebe1d5d94c9a6354b48bf029d2ed99ac3531232eb1fa768e68850fbd3ce921803c918530fb47a026e8da44b988118ea2225dd6a1cc24998cac92a56ae791d450
SSDEEP 192:sxZYRdyMqZjK1Ml8MkU/fassenaZdBzodpHLYHW6+WNGYvIuGGmtIgjCJ:sxZYWMU/fassenazq0HbGeOje
TLSH
T16062E8066A349977CDDBD219FA45BF53D6F91123E2905E44A9FC8A0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9623198c59c80aba1824744f5a0c990aee509b2ab07efd95ce776f032fa40a39
MD5 71058e1be57fafbd87093990ffbeac47
SHA1 2374db7709d6c58605f7fd7c85c6d25459cacbe7
SHA512 76a5b927c188131c01c9bc74eb9502da53c296e430b33e82629f919e8463691f4eccc7fc5c4f1bd3ccee418188c3abba0d73119f607dd74bb6122acb08a62012
SSDEEP 192:sxZYRdyMqZjK1Ml8UQvkU/fasvRZdBzodpHLYHW6+WNGYvKG1HmtIg5M4CJ:sxZYWqcU/fasvRzq0HbGUONe
TLSH
T14062D70A6A349977CDDBD219FA45BB53D2F91023E2905E4469FC8B0C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9af3e64e5e48723f3f118cc2f5aeca80abbff0176a9410f703324365558d53b3
MD5 1e126671e969263545f0a714ed4c7dfb
SHA1 3d185cfb6cb6281dc9ce5978c436cdbc9d6640a4
SHA512 35e2cca4a02c6d4e7a857434948f5d73b2cdb207ac1d9830648048c86022134129d1e934a607f55e159332ea329284c7647231bbf93759beee1bec2051cec4e6
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGA:05ppxnY753RNBvRJJdt7p5J91dX0
TLSH
T1A2B27D5A703E0212397E3988B39696364F4135637058E4AF7FB814A54F2BE225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c746c37c54e8f13cd9dbadc5218f82689ee35ae38ca175b83905f5c96d737ce2
MD5 44d43e8dbc80fba76918ad8625332b6e
SHA1 48f83270df498159a454a05aac39f8f86bde33a4
SHA512 eb57c7b453f486f6dbafcdcbd30e54ecfe2ccd9865e231ead3cf285ba8aba4220d166bb0414b9f49f777d4cea91c2073f22b23250689b433b3919e5d32253ae9
SSDEEP 384:nbiFiZcIffsNg8TUNTUlI40QckCr8/TphiftGWE3jYPQ4OObjI9G6w76hty/7Ig/:2FQXxwgjkvdoGWOiQ429Mp
TLSH
T150F2D3F698D78976E8AE4B87A77D2D0299FCC163B6884584B7D94D0CCC860BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 07d6fd5ff493b14d5c579e73cf3cc41465e914a7e342837bf96693d28cbd861c
MD5 6e9f85164b9dd96587c66b01f29d7d08
SHA1 ba2cfb45de81f13120694d7af8b320015c9017a4
SHA512 d25a0baf091eece155fcee833e53fb68da943f3fea57abcbd8013eaa111a006acf9739f1d6f52fe44058968f694d40d24a4f2e80dba0fe6cad4798e914bf53fd
SSDEEP 384:nNiFiZcIBsNg8TUNTUlI40QckCr8iTphiftGWE3jYpQ4OObjI9G6w76hty/7Ig/:EFQBxwgjkSdoGWOqQ429Mp
TLSH
T1EBD26C36E864CABBEDE74FD5B64A3A07AEE05163C6DC5AC4D5DD8E4C00971AD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fc447eb7f88738d674daab933cd514673d293f579790e774a4add16eaa1c0f42
MD5 6a23d9e8ea369fcefe65472f58b4e80e
SHA1 98ac414b46230398ff5351c92e52ca6db867a0ea
SHA512 b36635e46f3ef1e905ab2ebd213790eecbe3fedec5bb172244ae133873e0de33799783e824d1ad635e5a0bfce04aefd266c4333f9d35c72217c13eaf24bbf958
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9l2KphiftGWE3jyZphe4KV8p0xHDty/8:puFccps35wgbkUwkoGWOW9I8p0hvV
TLSH
T13AB26C36EC68DABBECE74F99B74A7A07DEE0527785984AD4CAD85D4C009719C030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7d6e98323fdc848324dc48be3f660a59ca80544a43ab1deabc49b21976d697f7
MD5 e80790cff8c852d667c6d184f3e3a02e
SHA1 6e21df4ce83555e80d3e0ce193bd14b107a0e738
SHA512 1ac53d7530feea01a6fad4842283ecdb6fdd51464b47ca089161d5bd5a4be66d481338779d8cf029e1612e6f069b0278783da87cad20a6d11d70f2a523fef0b8
SSDEEP 384:nppiF9CcmyWCs3sNU8TUNTUlIm2QckCr9eRgphiftGWE3jYrQ4e4KV8p0xHDty/8:pAFccps3BwgbkU+moGWOyQ4I8p0hvV
TLSH
T189C25C36E858CABBECE74B98B74A3507DDE09163C68C9AD4DADD5D4C00DB1AD430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f5d939555ebfe5465cddec067a0a4ae0e8cae6a1b1541a76e52c510f492fe160
MD5 d708b94bf3810f2b8d39874907a4b0e9
SHA1 ae7e49e33f115607e5ddaa57389395a488b3a0d0
SHA512 0fc5997053aa7fb51be0df97660bc058bd6097b01192815013f007d0ca42cec614955f5a56e2c1aa229c6f087e339f2e87805e27d5b60dd0df4530d196eb7eec
SSDEEP 384:npaiFiZcIBsNg8TUNTUlI40QckCrzubiTphiftGWE3jYpQ4OObjI9G6w76hty/7h:pRFQBxwgjkYjdoGWOqQ429Mp
TLSH
T1DED26C36E864CABBEDE74FD5B68A3A07AEE05163C6DC5AC4D5DD8E4C00971AD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ddf86a7f012479e56fcb2a1ea2edbfb6692fab9f063d64d8502b2e2ecd68f01
MD5 3ba23b7cbcb29b9c8b5d7326bb04c1f0
SHA1 89957b8e04528be92f2e10482b661ccb90e605c0
SHA512 822aa4c2cd9b90aa531f5e482dc65845fcc9569ddec58cc6d6b72c9862dfb9f3ac9e0b4078274187a6a749c13912cedea83eca01615a31a54401787c69dc30e8
TLSH
T17B41F898A6F91148B3B76F4AABF6A86D487BB8772E07D45D00010E4E0A23F44CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2056-202-0x0000027750F30000-0x0000027751F30000-memory.dmp

Download