8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1024社区发布器 10.1版/__扫码.浏览&下载 _1024社区.html
Size 1.3MB
Sample260730-xble9sep91
SHA256 8715f083441a904c00e365c07e22487b2ca2ba8dad0ee727173faa6f3b37a333
MD5 15280afe83c4f878e148e21115befc55
SHA1 0b14258bda8d938b9912fadab12603b001ce801b
SHA512 1706e300c677e64e4c79936184c4f95a0e4d35222e197a119ff653b61f72716a91b15fb9c43e7ba02adfcba1e33f40d27285875e003f03279cda0be21a1fcf9a
SSDEEP 96:Eao++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++J:EahIuyTFCseZ13FSr++YGqL/IT
TLSH
T14F550055D51A00A275CE056A3EEEE25E227C3A1B9FCD974D4D2737EDE0B260DB08CC92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4648	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299104661880195"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E99C105A-A5E9-45B1-B794-FBBF9C8F7072}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
604	msedge.exe
604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1936	1920	msedge.exe	86
PID 1920 wrote to memory of 4648	1920	msedge.exe	87
PID 1920 wrote to memory of 4700	1920	msedge.exe	88
PID 1920 wrote to memory of 4700	1920	msedge.exe	88
PID 1920 wrote to memory of 4700	1920	msedge.exe	88
PID 1920 wrote to memory of 3068	1920	msedge.exe	89
PID 1920 wrote to memory of 3068	1920	msedge.exe	89
PID 1920 wrote to memory of 2456	1920	msedge.exe	90
PID 1920 wrote to memory of 2456	1920	msedge.exe	90
PID 1920 wrote to memory of 2456	1920	msedge.exe	90
PID 1920 wrote to memory of 1260	1920	msedge.exe	91
PID 1920 wrote to memory of 1260	1920	msedge.exe	91
PID 1920 wrote to memory of 1260	1920	msedge.exe	91
PID 1920 wrote to memory of 2844	1920	msedge.exe	92
PID 1920 wrote to memory of 2844	1920	msedge.exe	92
PID 1920 wrote to memory of 2844	1920	msedge.exe	92
PID 1920 wrote to memory of 4988	1920	msedge.exe	93
PID 1920 wrote to memory of 4988	1920	msedge.exe	93
PID 1920 wrote to memory of 4988	1920	msedge.exe	93
PID 1920 wrote to memory of 4728	1920	msedge.exe	98
PID 1920 wrote to memory of 4728	1920	msedge.exe	98
PID 1920 wrote to memory of 4728	1920	msedge.exe	98
PID 1920 wrote to memory of 1836	1920	msedge.exe	99
PID 1920 wrote to memory of 2804	1920	msedge.exe	100
PID 1920 wrote to memory of 1836	1920	msedge.exe	99
PID 1920 wrote to memory of 2804	1920	msedge.exe	100
PID 1920 wrote to memory of 2280	1920	msedge.exe	102
PID 1920 wrote to memory of 1792	1920	msedge.exe	103
PID 1920 wrote to memory of 1792	1920	msedge.exe	103
PID 1920 wrote to memory of 1792	1920	msedge.exe	103
PID 1920 wrote to memory of 3672	1920	msedge.exe	108
PID 1920 wrote to memory of 4588	1920	msedge.exe	109
PID 1920 wrote to memory of 1408	1920	msedge.exe	110
PID 1920 wrote to memory of 4792	1920	msedge.exe	119
PID 1920 wrote to memory of 4792	1920	msedge.exe	119
PID 1920 wrote to memory of 604	1920	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1024社区发布器 10.1版\__扫码.浏览&下载 _1024社区.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa3985c188,0x7ffa3985c194,0x7ffa3985c1a0
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,10600121206825571144,17808399699010481798,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,10914351348213172599,2111472606219497886,262144 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,1369008833741183856,104469579777305950,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,2231162877053860326,7692806767266793492,2097152 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14304307439176884782,12725235017563785747,2097152 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,1577574311429679697,9327557981519067221,2097152 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,7058878542302819126,626963194031030801,2097152 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5004,i,9417647296932641002,1214683949767283691,2097152 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,10201485206932681529,12571752388177986911,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,17607502100934422124,14416362004450754761,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,5362588672319601670,15045885397217082794,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,5362588672319601670,15045885397217082794,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3576,i,9723187230742958594,1380800364636481132,2097152 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,146405862895769240,11318012514456114287,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,13904663993763987741,2476763341475717909,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7613761476749221718,15458346848939603585,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16765571111919268791,17511165256928285464,524288 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,1487648337821624026,12012468034066013098,262144 --field-trial-handle=2232,i,13203477104977181711,9306840292072081749,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 adf74540a08cc43d587732faa875b1728c6821c90f6966d898a9af88aa65d2c0
MD5 aa949fc66475c7e3994332b95786d4e1
SHA1 c7dc8b6e1b13568cf601e2f2797fa04f07bf236b
SHA512 76994f2800af0b4d91fb759ca11378f6a49e1f360958eb595f21c8b5682141dd88e2d79ec2df85fa1854b15189ca5792c7a849ef58d756f7e96f0dc6027a10ee
TLSH
T1FC716E3701C940C2D782013A64F26284F8BE82EAF53FDF5100FBAA7E4B97711815A1BB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c6e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c6e5.TMP
Size 3KB
SHA256 a3ee3c2485a78ef596f083f0b881e1543090058787c8499c3aeccd96109cf727
MD5 0c57790684fad642819192317361c014
SHA1 a810955bc2d2e5b7284fdd381a3f22a508ecb17a
SHA512 51cc3a1d179580b0c2782d978e8a9a5be2e7f467793d680f2fa08a89d5bd9caa0558fca37757b91cf920d7ccdc2cb7fbe64be4d214c279acb2eb16729336dd6d
TLSH
T188714E3701C940C2D792013A94F26285F8BD82EAF53FDF5110F76A7E4B93711815A17B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1ba62cb7b9466eb552a79139a41d8e2eebe5a0d1135b5bb467e5d612b2ce9c0a
MD5 ffe40051d270e0159a4ee98e8f8cb2f8
SHA1 244b0cdbbe25b540db85bccd053efd0fd55ac914
SHA512 369c9881d3124eaa14377c6e213b5d6882f9e979c5f1708380721e0cfdad06de107db3d3702eaa37026c001a24b2a04a77bc969bcc4bd36fbd936ce548349ddb
TLSH
T17631CCB3C3E4866ED90216F46A286E2BCE5C0A4583583C16CAE4EF1BD7F2474E20185F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e3037f889b126f3e6396f60fd477b5e9e6e34dc52e52f6e38766cbe44e8a3bc1
MD5 56a5007cc8ed1ff0e9f56d697b50e6bd
SHA1 2f322698f57a4c1d2857a4f9f222a1f34d075433
SHA512 cee239f41901ffbf49d41108b8faf94bfb3443dd92f593be818254da5f7df9d5791acc1d7336f4fb5bc8c2a2bfb0d83cdb7e92ea30a150b87618a77d7abc7dfb
SSDEEP 192:sxZ/RRyM/jK1Ml8Mka/fsszck1TIdpd51sHW6+WNGYzQJ01JjEIgrJ:sxZ//Ma/fsszckC5sHbGYq9
TLSH
T1F942C7566A349977CCCBD209BA95BB53D6F50473E2940E44A9FC9A1C00F6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3dbb3029fd2e8fc181ec7d7222352d841955f80659ba7130cd6e0767ac7e537f
MD5 0fcad685c4cf50a5387de09e0e589516
SHA1 c9311e33aa1b93f4f9e710f10c2381f58171f838
SHA512 6bebd9e5968244d611831395cb090814852c11d59a240ad5fc89a71089f2abef110fb400f017b3269d7e74dc4f90f62863a809a078920a73f62440ddb9aca686
SSDEEP 192:sxZ/RRyM/jK1Ml8UQeka/fssXKk1TIdpH51sHW6+WNGYz7s01JjEIg5YJ:sxZ//q1a/fssXKkCjsHbGaqa
TLSH
T16652B6566A349977CCDBD209B981BB53D6F54473A2940E44AAFCCB1C00F6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ade3e896b5e5bd340931008763e1b6c676dcb68c0dcd96244a27e8feb01aafc2
MD5 4aba1f14e9391a549fa793de1f06399a
SHA1 be74baebf63a52fd59a8869590fed306428c85ad
SHA512 6b1ed23a02d42ecf3fb864ed95d628c3257e9418c100b5449266cd2f82cc2c67c92d85e55e7f7b2755e927e91af10be59fe74e7fce99cb2b7d0b161e1778cea9
SSDEEP 768:dQW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj+roIgiVYH:dQW7kf0Wvqidau1jaa5LA3jVVH
TLSH
T1ACD2FA3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 49e1c19f8903954811b2c03926bc22b6fa3dbbcd513ecc0ad7832139860500c8
MD5 df46f221d4e24dc73e278ccd551972b1
SHA1 0f066351575b8d150939fa3b78a9fb9fb3eee9f3
SHA512 c64e0701a551ea6ab79225d89c4baadf3b68309daf557281e666b1895af2df2f54ad817d79455212e870c614cdd7688c1eb3e9e9e3324ed8efb1dc52978ddaa1
SSDEEP 192:uZm+xasuheOwQxMGsNyzQ1oh1BbxmoQmiU1Mav4aGBPK7hCI9jlEXdNYqCOOZlj8:jZcIhsNyzZbNhAbM238OObjI9G6w7bY
TLSH
T1C3929E326C789D36AD63A152F4C52B134FF9507BE3C85F40A2EDBB0C05F66AC131681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 55ceee692c924d5f85183cc2109a4be2feb121df3c69782532b631f7404b0435
MD5 f5ab77db230ffd4d1292a3e33abc7ce8
SHA1 19b748f9bbf32aa5ddd40dada343b8b53efa53c6
SHA512 2f72d86b01f4b8eb5e1ba3a766ab18157e7f29164e27c70adbd16c8aa900ea9f19461e22145801b6e787790b791e55d4034a8f5879bd1756354f82beadbfbb50
SSDEEP 192:uJm+xasuheOwQxMlnSzsNyuQ1oh1BbxmoQmiU1bav4aGBPK7hCI9jlE2ZNYqCOOU:tZcIbzsNyuZbNcAbM2A8OObjI9G6w7bY
TLSH
T194C229F158E74936D95E9303A3BD2E134EBDD067B2885A40B3D8A70CCDA657FD30641A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63659597fda42ddb22ad290321a4d27e8eb6ff85df395c110900b2beda6f68b2
MD5 150e35b08a52df07f1cddf9fd1eb749c
SHA1 105a1138f9886fc655e7b3065f9d9ffa9725ece4
SHA512 1f5e2e73391784aafa5d6cf8676328abb681ce604b3c7a178fe7e3d24065ad4c4308a17117f938f9659e22ad54b1bbd20a3aad02376b33e8a8647ed6164c91f1
SSDEEP 192:MONo64BAQmiUyT1uW5GBPK7hCI9waDUXU6:MONo6eAAYWQM5OU6
TLSH
T12E020A356C796C7B9EB2AE45F48637171FD8106BF6845B40E6E82B1C00E765C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dcc2b32abfafe14d819651daeb816bfa253713a15ebc603e6cc97ebd827b6426
MD5 e780e076bfab64780f50f22a33c1e842
SHA1 7a082412e28815d135936574e064510d330da143
SHA512 17f3e7dc03ae25302df667ed7b951cf3db1aac3b172b6d4fccda943d16e6d9fa29d9b51cde603614c35ea9340620c319f737fb5b123caf15b0fe9d5f569c2b2b
SSDEEP 192:uRm+xasuheOwQxMGsNyuQ1oh1BbxmoQmiU1Mav4aGBPK7hCI9jlEXdNYqCOOZlj8:jZcIhsNyuZbNhAbM238OObjI9G6w7bY
TLSH
T1E0929D726C789D36ADA3A152F4C52B135FF9507BE3C85F40A2EDBB0C05F66AC130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2a84b6a27902897abd45cc1bc471122206caca5fbab3041508ba18dc945c54f
MD5 0c6f9f2dad0467830bb511fa923baa6f
SHA1 88df6c36f4ed1cc00df7488089003c4d5507773e
SHA512 63be5f1d4c8dee024e95a86a05f670b0e11e4555931449e72451984f36ea9ed7a1b3909697520c4b3184a3de47cbff5d2582ab4818e1aca23bd371d27e548588
SSDEEP 192:SON764BiQmiUyNug5GBPK7hCI9jlECWwYqCU6:SON76eeVgQM2g8U6
TLSH
T102120A767CB8AC6B5DA2B581F48637131FA5416BF6886F40E6EC2B1C05FB65C230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 395e595d7135474079f33f07afa8f466260b731e4726c980d4b1134f5db607d3
MD5 07a6e6732430a4957265c2852435ab76
SHA1 02c270ee2fc9615723787bef7018231ff9c71bdc
SHA512 b4d26d56a7f09bef34ed813c6ac7962155257b9b768e72aa332c0e6c2e377f11eb33329047396976307c6e4d9779db13a578bf8269142d21f303668d0b5868af
TLSH
T10F41F658B6FD1148B3B36F5AAFF6A8AD487ABD372E06D45E10110D4F0662A00CD71737
MD5 SHA1 SHA512 TLSH

Submit Download