b53f7dee6c9ee0b61cab004632c4af279bd2143d2c500154de503e8fb9fcde3a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rst.sichuan.gov.html
Size 851B
Sample260817-pp46jazfpb
SHA256 b53f7dee6c9ee0b61cab004632c4af279bd2143d2c500154de503e8fb9fcde3a
MD5 0acf2f8100f018d0eab62bba08f25ce8
SHA1 d6149f961445cdacbd6e238b77ec7c8d3727f60a
SHA512 38ec2fbcb0294fa468f8169b30b5ef3f10a15295056c4c49d7898bb701453bb978c1b381d8704c211a2bcb1571b338bdf30ab3db9512f5baf204512dea1ffa7a
TLSH
T19001D02434E10D448672B3329FF7E27AD566306336A295107D8C7A13EF3662099B7BCB
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314434959975338"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{BA3EB61D-7A0D-47C6-A5C3-EF33474FB862}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2176	2968	msedge.exe	88
PID 2968 wrote to memory of 4592	2968	msedge.exe	90
PID 2968 wrote to memory of 1004	2968	msedge.exe	91
PID 2968 wrote to memory of 1004	2968	msedge.exe	91
PID 2968 wrote to memory of 1004	2968	msedge.exe	91
PID 2968 wrote to memory of 5984	2968	msedge.exe	92
PID 2968 wrote to memory of 5984	2968	msedge.exe	92
PID 2968 wrote to memory of 5480	2968	msedge.exe	94
PID 2968 wrote to memory of 5480	2968	msedge.exe	94
PID 2968 wrote to memory of 5480	2968	msedge.exe	94
PID 2968 wrote to memory of 944	2968	msedge.exe	95
PID 2968 wrote to memory of 944	2968	msedge.exe	95
PID 2968 wrote to memory of 944	2968	msedge.exe	95
PID 2968 wrote to memory of 2524	2968	msedge.exe	96
PID 2968 wrote to memory of 2504	2968	msedge.exe	97
PID 2968 wrote to memory of 2524	2968	msedge.exe	96
PID 2968 wrote to memory of 2524	2968	msedge.exe	96
PID 2968 wrote to memory of 2504	2968	msedge.exe	97
PID 2968 wrote to memory of 2504	2968	msedge.exe	97
PID 2968 wrote to memory of 1348	2968	msedge.exe	99
PID 2968 wrote to memory of 1348	2968	msedge.exe	99
PID 2968 wrote to memory of 1348	2968	msedge.exe	99
PID 2968 wrote to memory of 2796	2968	msedge.exe	100
PID 2968 wrote to memory of 4312	2968	msedge.exe	101
PID 2968 wrote to memory of 2796	2968	msedge.exe	100
PID 2968 wrote to memory of 4312	2968	msedge.exe	101
PID 2968 wrote to memory of 3016	2968	msedge.exe	103
PID 2968 wrote to memory of 5936	2968	msedge.exe	107
PID 2968 wrote to memory of 1132	2968	msedge.exe	108
PID 2968 wrote to memory of 3108	2968	msedge.exe	109
PID 2968 wrote to memory of 2536	2968	msedge.exe	110
PID 2968 wrote to memory of 2536	2968	msedge.exe	110
PID 2968 wrote to memory of 2772	2968	msedge.exe	112
PID 2968 wrote to memory of 2772	2968	msedge.exe	112
PID 2968 wrote to memory of 2764	2968	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rst.sichuan.gov.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffbb0e1c188,0x7ffbb0e1c194,0x7ffbb0e1c1a0
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,13088012652443350703,4836281972567451110,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,18015186653578777678,14213726095329963908,262144 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,12055124685216282029,11329807402817998476,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,10430216776420511358,8933308507881413204,2097152 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,14881005506797724053,7342759973174235713,2097152 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,6920830012749664104,14807125127080776383,2097152 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:9
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,9572354396402371662,5785751747249188213,2097152 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5164,i,10198561265093325553,5788325894885261486,2097152 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,14366449750356162637,8439876623826143623,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:14
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,11885830578330489685,2695036482932066620,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,8842755938922319516,5762497751477945259,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,8842755938922319516,5762497751477945259,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11143232656852376392,16814891834910084935,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,14314277395266522427,8096974440169695562,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,7488394107649548947,1434065164671515338,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,14651806362229418783,15538095704221256294,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,13181462900509277543,12244053719206537147,524288 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,13633269824852826277,13483208434906798836,262144 --field-trial-handle=2760,i,10206657885975593837,3555337040245563337,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fa592d812504300d0868730f43c3c7e1b2575cff3dac31ad0a6ea0aa6f03513d
MD5 8081c404f1502f6b90acee3cebb78cdb
SHA1 273b38560e9cf20d0c74766710f907049511788c
SHA512 1ada82d70aec03e995b002c605880e5a4b79493c6e18e831dd0e682389db6fafc58dae115a939d599f9d1abbf746c703272a3dbde2fa788b8f8b4f4d6cc53ed1
TLSH
T188615EBE432D05E2FB2845F249E1945A3AF4C05706271ED07C805FF298FAF6AA5E1163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599d30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599d30.TMP
Size 3KB
SHA256 7cfd5ce6627003894e1406a9a90a511d6654298762b52da5c9bd211bc5c11d59
MD5 739b6f98d406c43aaa269a1836629c82
SHA1 d0f3c1ef60126234c8ed4609abf6b433990f0c6e
SHA512 5f3c257b0042d782c9a3ab6e5ee4f108c889bc2bcb9833ef57dc8b42f5084c988d7f869055026c7d9ba031d847109997d8756798115554004a5484451d881fb1
TLSH
T1E061607E432D05E2FB2845F249E1945939F4C05706271ED17C801FF294F6F2A79E1153
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4b3cd0908fe1d7d4fd92e6fe73a47f74db772ca2fa2bbc8b5cc6ad4534d29147
MD5 2423f638807263c3f97d28a4c698c747
SHA1 9b0d4e26288d0403b85be811b805ec2e0ef63f14
SHA512 4363e54709f6d8af155eb15a5a7929fa47db2784689ceadd00607095f6231dcda1bc7594dfed53cfd5beff04387c3f19b9aed826b1d5d8c46e9e24032da52358
TLSH
T18531A2F783B4957E8A0196F0AA14AE1FCE1D0511431C7C5AC5D0AE27D3F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 96313e1f42f611c56cf5984f5240428fea6e561f9dbfb10cf73325740ef4a3e1
MD5 bca07baea811fe75eaa741917fb92379
SHA1 b48e6cd67fcfccd90e989c53c1508ee0b1a6fda3
SHA512 d864ecb87d15053351ded47c3fbb8804201561315250b31fcb42ac44ec323e01917d5e8260ef2c55cbdbb527f167cfe0a2426547dd3698e077adcd957c2b85a5
SSDEEP 192:sxRrRByM/jK1Ml8wbh/f5s3mprQ5VzoA8p47/g6+WNIYn8Ubh8GbIgDgJ:sxRrPlh/f5s3mJu/5IT4bQ
TLSH
T1A952E705AA346D7BCCDBD21DFA417F93D6F85573A1941E44AAFC8A0C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 88e5b2fd919c1f4d4f829ba53df117dc35f54ab056d48c3c2ce7bf2deab6e7d4
MD5 97fb291efde60b36aadd23596c898156
SHA1 6226bb4d886d5f08c1d493fdfd9621cca540def0
SHA512 097318de610d9f846cd1b45b30c94cae5cf94918ff4b3d89414824e251d2bc621bebe968a8eae6d8ef333fe039e2b95e63e22dd10cb92939d98ebf9c7ff3e39c
SSDEEP 192:sxRrRByM/jK1Ml8UQ6bh/f5s3CprQ5VzoA8pe7/g6+WNIYn823vh8GbIgDCJ:sxRrPqsh/f5s3CJY/5ITsba
TLSH
T14B62D715A6246D77CCDBE21DFA41BF93D2F85573A5941E44AAFCCA0C00E6ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5f80524ee782556ad551b3c0b165d2b3eb56a3a0d009d5e1670fb5a7cca355e1
MD5 1a308d128303c6a18d678c517270cb74
SHA1 b9441ec04620e96ce50150930772e04dca03cd7c
SHA512 34b6680a31247adefead01d4aa3e74eabb8d9b76f6536062b7bb23425d7f5f12069cd930ea0f2d2a64d5f67dc5bd8ef881a1e349841ed04eac13684239726c68
SSDEEP 192:sxRERByM/jK1Ml8wbh/f5sWmprQ5VzoA8p47/g6+WNIYn8Ubh8GbIgIJ:sxREPlh/f5sWmJu/5IT4bs
TLSH
T1FF52E8056A34AD7BCCDBD21DFA517F93D6F85573A1941E44AAFC8A0C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c2ddad77568d3b6a7393b010f43f4fb0a00321b1a2160e73111ab64d0c62e39b
MD5 820cf6f366465cce01fc54c209062cd4
SHA1 4ff2963aa89a051f49c5ece5434961023fd83e7e
SHA512 652446f143882df9d0107cee371a4fe472a9d02f2a6b9cf3a88c7b88ec5b12861a5fbc94a9369f22a6a26dfa71ced06b936ad498c4f3cd23f4a9cbf45bff1b4d
SSDEEP 768:wGedp6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4Y5roSh8r5Y:wGedp6WgoufDMu1jatVYyJu
TLSH
T197C20C2B640CC77E4F844EADEC29EED76DD801CB9B988D5447EA890C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 112aa9fbda7f33f6105bc6919f67b990dc87bac40b3827d78ec94e366dc6fe22
MD5 4aa8f9b662ef954f44c565a9f5224f76
SHA1 ee7f16e6bf334ba6e663b0937f6a4a73461301d5
SHA512 cbf5c161e89fc24083a9171e7e4c455500c7445b60ccab38115b3bd5ff5ed5ec66673473e09ef469ec37d657fb872b450baeb5f2e4b41ef580c6a8db4e42e5bd
SSDEEP 96:KR4H4Q414x4H4F414ZW4B4u40g454ZK44wg434Zc4/43424p414qH4L4U4R4l4T/:COjyuIQAhQVuu+zgsFGONcOHH2r6WwYk
TLSH
T101910643743612403C7DA71881798C2EB2C178663119B96B7BAD51AB0F2BF079DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 94500f840a271bd5a05e00ec8ed98a83bcb65cee447cd41dc1b87c68c5aae1ab
MD5 2c279849927930ef6caf59173679eabc
SHA1 2fb2a3435b20e6dc86b606ed99d1a5823aa54fd2
SHA512 b5531d24727bd93743a7b0561f06994119980b006472801dbc41462d415d5be24ff8e822a5de481a4423441b8d1cf89ca3f966b0a3be2c61075510cad9d3be5a
SSDEEP 768:wrv+4UNbdh39xBDZIO08jNzc4ReyIsPhcM:wbsbj31tc44bs5cM
TLSH
T16803CF36F8289A73ACFA9685F50B39537EF4521B81C91A94C9EE2F4C458B1DE130F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3aaee694afde73b6bb178faf5940911ab7d977908bcda915ed05f60dc76a1e4d
MD5 ae2d7ffd39bca7b7ad272615438250ba
SHA1 3205fb37a7ac3ccc8b3a24d6ada1c9abf9e81ba4
SHA512 98cc5b73c0442e34b3c3560f8ea2479b99403149a5384afe315cce3039e0e3d11df883d18a3070b1436d84b9fa46931f9bab6eedbc37a7cf7a32a47fa4f27b66
SSDEEP 768:Nrv+4UNbdA3YaBDZIO08ZNzc4ReyIsPhPi9PC:NbsbC3Ttc44bs5PB
TLSH
T14C13D031F8289A63ACF6A695F54B36437EF4521BC1C91A98CADD5F0C09CB1DE131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7ad0d1bef959b246baafb0989f188f40b9877ef465afc5231ade64f1dc853487
MD5 213f399e2a584d433d81cb96c59d6218
SHA1 485d283e995df2d576d3a673b84a1558cfd087ae
SHA512 313a91bd1fff994003ee5b2804f150db8704c112b6f8a575e67d42044954491f8da85ffde9cb71712f49ece8aff6f1173bda02a897dda807a6cbb22b2709b1e5
SSDEEP 768:4rv+4UNbdh3YaBDZIO08JNzc4ReyIsPhPi9PC:4bsbj33tc44bs5PB
TLSH
T11513DF31F8289A63ACF6A695F54B36437EF4521BC1C91A98CADD5F0C09CB1DE131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8f8c596de5d4b2d4769190e995eb4125d5a65f8cd196d124a98d4b2920b88c59
MD5 83befc8bf72f47f231e7d2352e0a0384
SHA1 986f6eee7cc29ab23124961f769171cdff991524
SHA512 d422f68d09884443db551b79e49a5fb47b8be3076dd9b04533f9c123bf7f18a957d1dcb0b678cf773c75c596f3a567f06ff9bc4b2a91eebbd868d636353e9b7d
SSDEEP 768:6rv+4UNbds3rKDZIO0QNzc4ReyIsX3eVH1S5D:6bsbS3atc44bsnEH1Y
TLSH
T17A03CF32E8789977ACF6A785B54B76533EF8912B82D81E94C5DE2F0C464B1DD030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3698910779fa161a3160c99667e75dbec4d3c027d61129251257721e35bbe0f8
MD5 1d4d8bd693a8c441508cbbf60ca69370
SHA1 6ef99907dca152a014e3deefc4c757f3d031cace
SHA512 6894e7f581bb53c35cc6d0b8cd73cdbae8c90ecbf3c2b5132ac4deb2aa5dd2318266c4f778173721627fd8dd1da9f98b3c247e3131b4b1022e3c1369e85c8a90
SSDEEP 768:Mrv+4UNbds3AXDZIO08fNzc4ReyIs2heVH1S5D:MbsbS3etc44bsiEH1Y
TLSH
T15103CF32A8789937ACF69685B44B35533EF4922B81D91F94C9DE2F4C4A8B1DD031F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download