099297421ed292111003948ab788b95959dc327f3c4ece4262fae21340064ed1

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区_最新网址.html
Size 1.3MB
Sample260730-xble9sep91
SHA256 099297421ed292111003948ab788b95959dc327f3c4ece4262fae21340064ed1
MD5 191ed2f790ed01bd8f81e8fae3aa495f
SHA1 1e1bcdf57e82d2bb4cbf1dd3e1b666b1aec2cdaf
SHA512 5e7aed8ec76d17a5d895f695a1dac4e3104ad58b436474ff7f331c2473e4945beca30376c7d861eea908a3503e6590f68f419404086ac4a95d7eed765523e7e6
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++p:EaK2IuyTFCseZ13FSr++Y8xU/oT
TLSH
T18C550055D51A00A275CE056A3EAEF25E227C3A1B9FCD974D0D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299104606722463"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D5153D2A-D9C5-49D7-BD42-EA5CD94EEB7D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2464	2320	msedge.exe	87
PID 2320 wrote to memory of 1172	2320	msedge.exe	88
PID 2320 wrote to memory of 5000	2320	msedge.exe	89
PID 2320 wrote to memory of 5000	2320	msedge.exe	89
PID 2320 wrote to memory of 5000	2320	msedge.exe	89
PID 2320 wrote to memory of 2012	2320	msedge.exe	90
PID 2320 wrote to memory of 2012	2320	msedge.exe	90
PID 2320 wrote to memory of 2132	2320	msedge.exe	91
PID 2320 wrote to memory of 2132	2320	msedge.exe	91
PID 2320 wrote to memory of 2132	2320	msedge.exe	91
PID 2320 wrote to memory of 912	2320	msedge.exe	92
PID 2320 wrote to memory of 912	2320	msedge.exe	92
PID 2320 wrote to memory of 912	2320	msedge.exe	92
PID 2320 wrote to memory of 4388	2320	msedge.exe	94
PID 2320 wrote to memory of 3744	2320	msedge.exe	95
PID 2320 wrote to memory of 4388	2320	msedge.exe	94
PID 2320 wrote to memory of 4388	2320	msedge.exe	94
PID 2320 wrote to memory of 3744	2320	msedge.exe	95
PID 2320 wrote to memory of 3744	2320	msedge.exe	95
PID 2320 wrote to memory of 2044	2320	msedge.exe	98
PID 2320 wrote to memory of 2044	2320	msedge.exe	98
PID 2320 wrote to memory of 2044	2320	msedge.exe	98
PID 2320 wrote to memory of 4356	2320	msedge.exe	99
PID 2320 wrote to memory of 4356	2320	msedge.exe	99
PID 2320 wrote to memory of 1908	2320	msedge.exe	100
PID 2320 wrote to memory of 1908	2320	msedge.exe	100
PID 2320 wrote to memory of 4676	2320	msedge.exe	102
PID 2320 wrote to memory of 5040	2320	msedge.exe	103
PID 2320 wrote to memory of 5040	2320	msedge.exe	103
PID 2320 wrote to memory of 5040	2320	msedge.exe	103
PID 2320 wrote to memory of 2916	2320	msedge.exe	110
PID 2320 wrote to memory of 4636	2320	msedge.exe	111
PID 2320 wrote to memory of 4916	2320	msedge.exe	112
PID 2320 wrote to memory of 4624	2320	msedge.exe	113
PID 2320 wrote to memory of 4624	2320	msedge.exe	113
PID 2320 wrote to memory of 3844	2320	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区_最新网址.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffedc9bc188,0x7ffedc9bc194,0x7ffedc9bc1a0
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,18192291208696870479,10824003912441366071,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3486664398237255269,10261495740994320950,262144 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,4157812655451144276,17856690684448476466,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10090604542638173662,11019809146062711857,2097152 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,5780913073744430750,7377179420566490742,2097152 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4919364848166753906,5634841936528866531,2097152 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16289207485568248851,14710717270045531055,2097152 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5000,i,10957918742919829530,9903461078318449481,2097152 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5229699894136475321,18332602495625057365,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,9363335954649460962,6307042168058973530,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6355649329243228481,14175431024089419643,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6355649329243228481,14175431024089419643,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3600,i,15237633032915343531,613105562073660009,2097152 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,13507495495802704271,13537312366384471922,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,6715419873516282299,15060151141488990138,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,17764561046846333361,14488461526043068727,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,9816948751874131731,16497864186814956034,524288 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6428,i,11595081569923715251,14166923227740392830,262144 --field-trial-handle=2328,i,30948598018821963,2177265707590930662,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

8903d3ee-b682-4581-ad8b-9ca8ee6f399c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8903d3ee-b682-4581-ad8b-9ca8ee6f399c.tmp
Size 30KB
SHA256 ecc9b6a7dd0ffa506e563fae747439dabc80f44cf00d8af1c334dbca14bb8acd
MD5 d67749125a18f956347bbae6464d6307
SHA1 d9f1bc17ce966e858ee7de24f176a8c7288a5818
SHA512 b368b22e5172e76d37e37727c049aa3866f1a898601a3da887698d5d56e5e2685025ca09b4afb1a8ba6f2512b1aea1d5bb2b1b1b4608ce0620b695e90d9cdb03
SSDEEP 768:l2cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNzroKg6n:l2cv21wWvu+Z+u1jaeFLeRNAK3
TLSH
T126D20B2B280CCB7E4F841E9CED2A6F866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 66eb45720484d1f342de4eb6fb4864e3bf458f6bd153000d0f4fa4583f383fb8
MD5 3b868a86b8fbac79cc4744580e4d183a
SHA1 66b61c302b25c6ebf6ed8a0fdc260f8d6160546d
SHA512 571fd30fc0c234e93116d600b2cb0494416840ff5f242686a1b2d9e1acfe0ed726335feb5b58bd6fb2d42b35115d6156f7635f5724240727d6af9f90ddfa5872
TLSH
T10451D6384711345CE76A01F1B1C30CA6B1BAB6C1F5E7DFFA07A3A475DA1E7AC8814654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a66c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a66c.TMP
Size 2KB
SHA256 ef02c3545b80a50bfbe7a03f711e4cda5b4668247d1d91ec777ddffcab572a00
MD5 996b86ba89e371ade1a31228c6a723d7
SHA1 dcf0be00e8f2faebc35614c69904e52570386b7c
SHA512 102ef3130b8e076ce55328dc39104b625071749795b741cc1fa93bc025c54636a8b9682930f3e8bea9d5257a24d77e0bdafdb6789cd9b162a3b2bf1061fd351d
TLSH
T16151B3384702345CD35900F1B1D30CA6B0BAB6C0F9E7DFFA0B63A475CA1D7AC8814654
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 43ab0b6eaf0ed09a0ce2c6dc7f114685df1c5827e9fd48bd4d9ef56e3127385c
MD5 2f7c0d2187a55fccf1a2fc3b4272c952
SHA1 bf3b4f9a4602a5e05d028c4f8d2929d3eddc9273
SHA512 7a467b3b205caa652709b72a6a117f3faa51739da77a3a5c52e7ea189c271e54b15a1bf70b2c2cbeb6f288ac6d9829fa71e71454e6a0e0c08804a7d0b4f38976
TLSH
T1D4419CB3C3D5821DD95116F4AA246E2BCF1D0A1883183C2AC9D5FF1BA7E2471E20154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 01ea97e779a8b571c8088200aa58d5bb057fc2b70692c4b23f474c9a26f0a376
MD5 dbe67c13b3ddeb2fab8c32038585096f
SHA1 a8c5c691036d5ced0e314e389d8636708a2d5926
SHA512 72541a33563841857b0a8dd666eae29ef988189b170f3bbca61e8cff47a9f53d21ff29a19562708c278c07996aeab66c1c83bcbe3627a98b2d96ae282109c971
SSDEEP 192:sxZjRgyM/jK1Ml8Mkx/f5swPBWnIdpdkFo3HW6+WNGY9IKJrvIgrJ:sxZjSMx/f5swJb+eHbGw9
TLSH
T1F842E8166A345977CCDBD209FA45BF53D6F50472E2940E44AAFCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cc7afd057b95ae6b3593365b078d8fe2e2c1a8699f587e830ec5dfaed785eece
MD5 823cab9d82813a21f94efb460503305a
SHA1 1e1b420c1c1c41afe2fbf20704077b698e296611
SHA512 ce14f12058fc1f6ea45516075dc149453269f3b16eb30f2b84cd6ebe27dfdcae50a27147070d8993175dfad5c5ded15fe048feb8ed8181649076053ff6237319
SSDEEP 192:sxZjRgyM/jK1Ml8UQIkx/f5s1PNWnIdpHkFo3HW6+WNGY9IBErvIg5GJ:sxZjSqrx/f5s1VbMeHbGAk
TLSH
T19152D6166A345977CCDBD209F945BF53E6F544B2E2940E44AAFCCA1C04F6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b779afed65d8dd49cf8111fe44d62e69df35b9c24cbde40e8152ac63c3a6f45a
MD5 6030ada34eeeba72ea2855da6415b8ac
SHA1 aeb29e464e151c174b56f2f045a40d3ee4f47596
SHA512 c056591727850531f92fe0f4db8b05bac16d6cfc671142e9fa660e0cd9468a7031df7c36b9261cc534ef361c7a78c95cb8fcad042a681419f0417203a057a4f5
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+HyKokuK2EKnqrkAKNCK:mThJ3hn
TLSH
T1A6A10316313A0282387E785896A68B275E8231A33458A8BF7BF905710F27E517DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4dc7a768c6d160bd1e05c8d66145ff3626a3ab95e2dd7e42bebb7c0f4ed3b6d0
MD5 6dcf95929394f4a54ad0eca735838fb1
SHA1 98867305e32b3ab0497d97d28a584b54f613eedc
SHA512 13d7878e8dba4c0894e8469677d5d2989517e87e2329dbed5bafbc589a69572b55e0e98ca4e2088ba633359feace8fdf9127230bfd0da2fd62d5e07918d7a017
SSDEEP 384:YFiZcIvzsN98TUNTUlIl6BqW4ziZ02e+CnOqEl4/lOObjI9G6w7ul:YFQL4wgAEHB/OHlSl29MS
TLSH
T1A5C217F258E74936D9AE5B43A7BE2E124DBDC0A7F5845A40B3C89A0CCD961BFC306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0f1a4d174d8732c85cdc684499ded8d6110b3c188606380527a02ad1d203575e
MD5 69b7922572f838f028ebdd624ecfa745
SHA1 eea0f446f0e69a35e0dd1488a472e95833de1fcf
SHA512 46207295a89c574d4506d2f2e3cd635839708a722c20eec449e0bd7db8c39410710de629ce5a63ccbf897f21653bd001c3a3345eadd701218863ed4b9ab9ed3c
SSDEEP 192:u5LsNjNQp6qWQF+YLelVQmiU1P8p4e+CGVgOqEl4B7Jicqz3At:2sNjNBqW4ziZC2e+CnOqEl4Kl3Y
TLSH
T139423B36EC385C765EA29545F84B37136EB981A7DA842F84D5DC6F0D05EF39C230AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8d6541e5e394325f720e6679af0309cca759f3b2a6cc1ca831d1369bc3a403b9
MD5 b337106670abf76b41a196213251e264
SHA1 c74b2cb7c4d705a205d9834c118dca9f0aa4b1a4
SHA512 3fc11afd3d63c692b2ef83e70e3c1afa998ad7cc41c9e360d4bc42a383d8cac21f5d8d189d565f5d5f156a2628d5600d3178ff100e290fa73c277f1bd6ac0cbc
SSDEEP 384:ZZcIhsNj6BqW4ziZC2e+CnOqEl4KlOObjI9G6w7ul:xhpE5B/OHltl29MS
TLSH
T1E992AE32AC384D769EA6A541F4C737175EF991B7E7C81F8491DCAF0D06EB6AC030681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f03b6a7ed9757fe2ce9667a46e88422e7dc810d0e2c059d176f48dee39297db
MD5 413ccf8a8c43ff2d118196cb847fef42
SHA1 5721fc395d7dc5b0f99a25fc77af1933e776af40
SHA512 e2cde5ebb42823952c26c9dd4a9e9250b3bc8e6adf8b0f2f5bb16eb26c81653b1e1ac48ea3901d6abf747df1105c140c4997f0b66cd48c7a98fcf22817b276cf
SSDEEP 192:JONt6v+YLNQmiUyZAZh+CGVgOq8usET7U6:JONt6vz//Zh+CnOqyEPU6
TLSH
T18502E935AD782C7B9EA2AE45F48737176FA8217BE9912F80D9D82F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91fee85e4d5b0e76947c5d8c540047d86b302f30b6e6bfa298f14106d1284c67
MD5 435755046a02f7a943f31bd30083790c
SHA1 47283c7a48e5b8eaf7705039444e03dbe45c9bdb
SHA512 daa2de58a8266295c723dde7afec71b70ca6b3d7dddaf601f12bc6e815f3adb03f543b10c1f876ca07eefc4c3a617ae3cb469a2cb9d5e82944ca488f8e76f55d
SSDEEP 192:QONm6v+YLFQmiUyzAih+CGVgOqEl4aCHcqzU6:QONm6vzXfih+CnOqEl4DlU6
TLSH
T143122A36B8385C6B9EA26945F48737135EE95267EA853F80D5DC3F1C01EF65C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2956182e-6b02-4d6b-a19d-245d35085924.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2956182e-6b02-4d6b-a19d-245d35085924.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a3390a2e091c5d1ee7afeb32beab2f8fde5c77b306fe61e21edfae4afdaba7c3
MD5 91a8388e0d959055a547475d2df63506
SHA1 3f659f3e7fbeff16397f4311fef6a02e8e783572
SHA512 1550d83d62ba19f3ddf71441a6225074c83ddd3c1e663212ac3c4a4b3cc6a5997c348cf71f6416e17106bd9238ff8bb2f570fa38dfce4dda24cde73155064a37
TLSH
T15A413B98A6E9110CB3B76F5AAFF6A86D487FB8772F07955D00010D4F0A62B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download