518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/_1024社区备用网址.html
Size 1.3MB
Sample260730-xble9sep91
SHA256 518f329d59e3ab92f46064add64cd61aa73862cf0cf37081b99af2380ac6bfe9
MD5 77d8030e6ab130d612e2fbbe896dbd33
SHA1 94bcd98aac314e2e3088515e9ecc82de9d040475
SHA512 fc30b317253da5acdea37b39ae444e15a86284fc260459aec5d7081102aa4b607424558686eaeb58a71b8474f49184353cf7b226aeea30d04c92c25e4db49707
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++P:Eav2F+YhwIT
TLSH
T10D550051D81A40B271CE05A23EAFE25E263D7A1B9FCD1B494D2737EDE07260DB09CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2208	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299104649006364"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{4635DC5A-126B-4193-B621-2A632CCEB650}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4992	4224	msedge.exe	87
PID 4224 wrote to memory of 2208	4224	msedge.exe	88
PID 4224 wrote to memory of 2380	4224	msedge.exe	89
PID 4224 wrote to memory of 2380	4224	msedge.exe	89
PID 4224 wrote to memory of 2380	4224	msedge.exe	89
PID 4224 wrote to memory of 3764	4224	msedge.exe	90
PID 4224 wrote to memory of 3764	4224	msedge.exe	90
PID 4224 wrote to memory of 2332	4224	msedge.exe	91
PID 4224 wrote to memory of 4016	4224	msedge.exe	92
PID 4224 wrote to memory of 2332	4224	msedge.exe	91
PID 4224 wrote to memory of 2332	4224	msedge.exe	91
PID 4224 wrote to memory of 4016	4224	msedge.exe	92
PID 4224 wrote to memory of 4016	4224	msedge.exe	92
PID 4224 wrote to memory of 2884	4224	msedge.exe	93
PID 4224 wrote to memory of 2884	4224	msedge.exe	93
PID 4224 wrote to memory of 2884	4224	msedge.exe	93
PID 4224 wrote to memory of 3360	4224	msedge.exe	94
PID 4224 wrote to memory of 3360	4224	msedge.exe	94
PID 4224 wrote to memory of 3360	4224	msedge.exe	94
PID 4224 wrote to memory of 1452	4224	msedge.exe	99
PID 4224 wrote to memory of 1452	4224	msedge.exe	99
PID 4224 wrote to memory of 1452	4224	msedge.exe	99
PID 4224 wrote to memory of 2032	4224	msedge.exe	100
PID 4224 wrote to memory of 2032	4224	msedge.exe	100
PID 4224 wrote to memory of 1256	4224	msedge.exe	101
PID 4224 wrote to memory of 1256	4224	msedge.exe	101
PID 4224 wrote to memory of 1924	4224	msedge.exe	103
PID 4224 wrote to memory of 1748	4224	msedge.exe	104
PID 4224 wrote to memory of 1748	4224	msedge.exe	104
PID 4224 wrote to memory of 1748	4224	msedge.exe	104
PID 4224 wrote to memory of 5004	4224	msedge.exe	107
PID 4224 wrote to memory of 2428	4224	msedge.exe	108
PID 4224 wrote to memory of 2252	4224	msedge.exe	109
PID 4224 wrote to memory of 1592	4224	msedge.exe	110
PID 4224 wrote to memory of 1592	4224	msedge.exe	110
PID 4224 wrote to memory of 636	4224	msedge.exe	117
PID 4224 wrote to memory of 636	4224	msedge.exe	117
PID 4224 wrote to memory of 3424	4224	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\_1024社区备用网址.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffefc57c188,0x7ffefc57c194,0x7ffefc57c1a0
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,3805359617162680862,17179389081706993720,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,14560610079323865998,11063923297533852192,262144 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,2936196724649429946,5765709248783763742,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11369491244889239951,18082651303018283442,2097152 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15942487868844556141,2096686070312916665,2097152 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,14695497374228721527,7876905778915707453,2097152 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,16126503325253820285,8607843869908308782,2097152 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3632,i,10237060859764639724,3882880477938158070,2097152 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,10253218853578729976,15334994333410987110,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,14553926821686293367,2321193024937568311,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,11184958842317465720,15104458283700431285,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,11184958842317465720,15104458283700431285,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4592,i,3708546993017172837,708636405879118760,2097152 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,4372524460630039251,8692817853197655654,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,16966230205306604779,1529740900864188484,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,7687939656563089967,3259955645161368074,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2940,i,5096963628864739670,13621118375668797613,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,14965735199716163272,11217488861169748280,524288 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6340,i,9136270574718979521,11939010525010819787,262144 --field-trial-handle=2304,i,8443096882801343925,15425205357228556537,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6c45ce931cd8b0cb4ee86ba1826bbd249338baeb013d20a071474f0de5e7d945
MD5 9a5e25c5407ee84c58fc53ecc9dffab4
SHA1 3d53de759a9aa471d31a7bfacf947ad45f2d579b
SHA512 e9a5028172dec773808fc63d8ce82b707e95d048e9a514a9051bdf3a778cb70da2fa1bfb88d692f97e8cd5861b9246af66c84ae3310916b9eed758a2fe256061
TLSH
T1C3711B1840F10F91E3B26FF1CFE316DA3D724D888AA35D7202849B7E9A3B73084E6545
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59206f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59206f.TMP
Size 3KB
SHA256 76eb6a65b843d825368fd9993ab4c507935bc59d30790bc6abac41954353e7a7
MD5 bf40929b22011f8022a5c8c9acf9ec10
SHA1 e86c7d5a8c40946ce971ad499783c446a6c7e427
SHA512 7e8568cc16c080e264f7f1969843192afcc593cbe5204b3a689fd1215dc4c59c1742ddcefe1edf38fc4ad604a28c3042b655b08797ea2d87c9377353863742e6
TLSH
T1FF713C1845F10F91E3B2AFF2CFE216DA3D734D888AA34D3202D49BBE5A3772084E5545
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dcdc4882ed5699ca9e09826d8e833b7bc9c1fa368630598bb7860285c19ddc77
MD5 97296fa5fb17801b420f75006413a287
SHA1 c82049df97a5bd1b48b47f21b0ef211c371c0fe1
SHA512 834bfbab37fefd10cef7b2dd99865138e29c1124ab1397aa910223bbb1204b4974347848b393615e559267841a0c11ac4c2dd9752ee5cbd64dd27c01c88ab916
TLSH
T1F1318DB3C3E5856E990156F46A246E2BCE5D0545831C3C16CAE4AF1BD7E24B5E20185F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 671bf03c83f00e8b0509f9ccedfaa25b405b031e25b0758f4f920242687c0002
MD5 8c378c823fb0a20a4177aabd395f75d4
SHA1 73e841b4d6533e01783b054f8876f5764114c549
SHA512 443167de56141d4af16b2e196ba3ac00cc4ae79843c02877e31ef89f7400ef7088b5d7d71346c54ff124667ae1d8fee63ef51dd4e245127ae962675700251f50
SSDEEP 192:sxZGRGyM/jK1Ml8Mka/fGsDrtIdpdIgHW6+WNGYwKzy++IgrJ:sxZGcMa/fGsDrOvHbGjh9
TLSH
T12442E8166B3499778CCBD209BA55BF53D6F94473A2940E44AAFCDA1C04F6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e93379aa0328df6990f093d919cb4c786f83a847fe5f9c99886d32080dda144c
MD5 862ec5cedad20af3c60e9a2316ee6f2f
SHA1 7106d747de40c1834cd60ce5d56c2bb794f048f4
SHA512 a3edcb45198825cbefdb86bba031949afa873659af23a245a0c1514862d3df37501792b97dc1032780e069d093e20d8a5c832415125291183a0fb57408046265
SSDEEP 192:sxZGRGyM/jK1Ml8UQLka/fGsNntIdpHIgHW6+WNGYwOgy++Ig5PwJ:sxZGcqga/fGsNnOlHbGOhS
TLSH
T1A552D616AA349977CCDBD209BA51BF53D6F54472A2940E44AAFCCB1C04F6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1380d21da0223e157f637b6699377bd37281f8fdf7f3bc1a6313b8c324ab9aa3
MD5 f5f9d6d43ef099845fc3b65c695fb87f
SHA1 e546a33de90e9f8435a1ec6947fd5492769ecd9d
SHA512 bffb208582a61052995b07ed5675ef48c237f1640fa3e03fa4db98067ad3e6a8b4dacc5065ce5a9d43a13ade1e8c686cf1d212fd71822ba4ca3cdf0664be26e6
SSDEEP 768:ot4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dXrohgcbaM:ot4jeXmWvmKLEu1jacPLZQdEdj
TLSH
T12AD20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 59eea2c27abe0ebbd768b299a8dcbdf60aa422f4efd51e029e1b54d1606e113c
MD5 f805b9569d6f30dffbdd02fa82d02162
SHA1 2ea00d5894f8349c66b2957b27c6e87d258e1757
SHA512 865955d03e38509dbde5bfa45862de85f73cba29ac481f900d97739b53c58170c4f5a80b2dedfd95b9fc84cbd2aa3ce8db4f41f534b427ea202c381c76f69cdd
SSDEEP 24:Kd2fZKLaYdM404sY+/IjO0Ki3ha401EWkSmqM782yyXYQf3kVaadCC+4SO+lIjYr:KA7IVKMMAQyFpIxKCkUmPI1KIEIryV
TLSH
T16D91B112347F13133C3D290896559A2A8F82F1A33019B46B7BAD10B24F2BEA41CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

010785f1-e7be-4921-b30a-cf72c8e1e4b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\010785f1-e7be-4921-b30a-cf72c8e1e4b3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 26be56970400299f3182e7b7147f56a24bc171c6da756d242e02dc9ee1a7701a
MD5 5cb0f9fb46f520130b09645db07d8392
SHA1 531f53819d98920226ab41b1fa03fd7ee09b9f82
SHA512 7c257aa19ffec0240d4f0dbc36e620d2165025407e7747342517c41125c9ed0bf244972837864f149132bb45011727c029fa28bf263eacbab545864dae445928
SSDEEP 384:rZcIhsNMU3wkhBf+o8hy9XPEFD+OObjI9G6w7KLU:zhGp3PiD+29MuU
TLSH
T113928E326C385C779EE29542F0C736235EF5517BE7DC2B84A2FD9B0D059A5AC0316C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f408eac71a00e5bcc09c895fcdf057c5f6c26e04d2408c8e9abab42cc521497f
MD5 d36631d01b89f6a768d1f2735e395402
SHA1 0d0adbdcfe08bb10ddc397640514d21a5587270a
SHA512 fac33ca816790b95687e0fefe837481a191dac8321c0edb0aa1d3c420884d52cde88ea519accc98ab2928aab646d55476ee89954c9c7141a2c962c13a7d56dcc
SSDEEP 384:jiFiZcIzzsNN8TUNTUlIl3wkyBf+o8hy9XPKFD+OObjI9G6w7KLU:OFQX8wgEp3P8D+29MuU
TLSH
T160D229F258D78876D9AD4B43B3BE2D124EFDC067B6986684B3D85A0DCC561BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e81030f36d80ef40d606fa5aa4a685694534763d7459df90c437d4622c0b232c
MD5 2c981755769922ab56fb1dee8562572e
SHA1 9ea2e5691b04f052426af646fc4ac59c3ca269dd
SHA512 058f6c2ee1adafe748c56376fd542ea196f323935b4e14a6955e1b2b04bc606ba5fb8cda43d295e32692030d33db5da20ee1ae93a73d234f7412e82b4f13ac89
SSDEEP 192:EONT6hZ0QmiUyAepc/+jVSjzorh8F45wOZDSjU6:EONT6oGpu+o8hyH2D4U6
TLSH
T1C302E93968786C678EE2AE45F48727275FE5112BEA956F84DAE81F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2a921e0ab55c765104ca92f07a64784abf1d64f12b50bcfde830d8f528a4e7f3
MD5 3997e1bffe2434262a39a243016b8c4b
SHA1 86adc5b10783ca3cc8248edb792cf3d61665bec9
SHA512 f3f431f8136035ca14a7053bfdfcbd91dcc689f2cdb515968e390cb8eb319b7180027d22936f4c74ebc77f064d0458cd768d0c0df94ca51d996d2da6f5d05ca8
SSDEEP 192:ujLsNMUlQpkZEorQmiU1X3e4H/+jVSjzorh8F9XMEB5cFTDOq6U8:EsNMUlwkhBf+o8hy9XPEFD+U8
TLSH
T147322A366878AC675ED29685F04732239FF50167EAC97FC4D6FC5B1C00DA6AC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c2f5d4529ea4334ef76cabeae14d74ade99818825047519c6bcbe0b10a7baf6
MD5 92c174588a589a1efcd046a4118396bb
SHA1 f6e16d8811fdd036afc5e52e355645f0db6f05ea
SHA512 e24ef6a75f4bb45f690e6c81adcc57226d31defd86667ec96607ed58bf477e6c991641757948d05be7a306a9ceab201f132020d678432949a41d90fa5bc38ed2
SSDEEP 192:LONW6hZmQmiUyKezc/+jVSjzorh8F9XMEt5cOqDOq6U6:LONW6uizu+o8hy9XPY9D+U6
TLSH
T1F312FA366868AC675DD1A985F08732235FE5522BEEC97F84D6FC1B1C00DF6AC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7a7c2e5d91caca440d4f9c46b5d754dd1359cfb70b5115d68ff899c82c6137c9
MD5 003cf47e6c06f41c5b61bdbb643d6836
SHA1 aa4f4f93bc1be8f1395cce12d71b6f02e1be9ae2
SHA512 25c138f0e36bae4f13cdd666a0384af99c2ea3bfe3655f31714a58eef529348162cf92ffc4c36ba84398a22c1d0e4cccc20a50ff6a87d07a4d55b6878b9214da
TLSH
T1BD41E69DBAED1148B3B76E5AAFF6A46D447F78772E06D05D10010D4F0A62A40C971B33
MD5 SHA1 SHA512 TLSH

Submit Download