01644da213f8458177f02e6d5fec529e3c8fd1bac86b0c1771d43b961079ea32

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ci4_payroll/app/index.html
Size 134B
Sample260925-wp71rashpc
SHA256 01644da213f8458177f02e6d5fec529e3c8fd1bac86b0c1771d43b961079ea32
MD5 cbae23ee54079b76d0410ea9411af76d
SHA1 292776494c22dba225177561b880cbd9620ec7cc
SHA512 c1cca4cb444ef393a8695c295effb91c4b8ed2a5e4ac71df1d6ae77244bf6f23be4c777411c64c94fa363d1f91c0ffa32131c73291f71dfbf3afd10976a42cc7
TLSH
T12FC02B4B310D1044132363800EC03B60354303C040C309841F87D1138A0451EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3824	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{8E99B59E-6DBE-4A3A-B19F-7F8CD2A647A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3216	2944	msedge.exe	91
PID 2944 wrote to memory of 3824	2944	msedge.exe	92
PID 2944 wrote to memory of 1540	2944	msedge.exe	93
PID 2944 wrote to memory of 1540	2944	msedge.exe	93
PID 2944 wrote to memory of 1540	2944	msedge.exe	93
PID 2944 wrote to memory of 3460	2944	msedge.exe	94
PID 2944 wrote to memory of 3460	2944	msedge.exe	94
PID 2944 wrote to memory of 5016	2944	msedge.exe	95
PID 2944 wrote to memory of 5016	2944	msedge.exe	95
PID 2944 wrote to memory of 5016	2944	msedge.exe	95
PID 2944 wrote to memory of 4500	2944	msedge.exe	96
PID 2944 wrote to memory of 4500	2944	msedge.exe	96
PID 2944 wrote to memory of 4500	2944	msedge.exe	96
PID 2944 wrote to memory of 4256	2944	msedge.exe	97
PID 2944 wrote to memory of 4644	2944	msedge.exe	98
PID 2944 wrote to memory of 4256	2944	msedge.exe	97
PID 2944 wrote to memory of 4256	2944	msedge.exe	97
PID 2944 wrote to memory of 4644	2944	msedge.exe	98
PID 2944 wrote to memory of 4644	2944	msedge.exe	98
PID 2944 wrote to memory of 1480	2944	msedge.exe	103
PID 2944 wrote to memory of 1864	2944	msedge.exe	104
PID 2944 wrote to memory of 1480	2944	msedge.exe	103
PID 2944 wrote to memory of 1864	2944	msedge.exe	104
PID 2944 wrote to memory of 2916	2944	msedge.exe	106
PID 2944 wrote to memory of 4428	2944	msedge.exe	112
PID 2944 wrote to memory of 4912	2944	msedge.exe	113
PID 2944 wrote to memory of 5024	2944	msedge.exe	114
PID 2944 wrote to memory of 2376	2944	msedge.exe	121
PID 2944 wrote to memory of 2376	2944	msedge.exe	121
PID 2944 wrote to memory of 4548	2944	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ci4_payroll\app\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8be57c188,0x7ff8be57c194,0x7ff8be57c1a0
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,17285821343481538003,247482470712750060,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,13716244927394767299,5772063878886734862,262144 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,14586512190104674158,17904025617604525049,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6716423514835098171,6110521759190072087,2097152 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,9328655525646238204,11159479788898502374,2097152 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,7072756402585072696,10123613290082763886,2097152 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8433289071161147267,14480209066500338078,2097152 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,12422517579048719540,3627144137618088559,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3433393254849926382,5588456512529911922,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14073492938320256310,6992133802933910299,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14073492938320256310,6992133802933910299,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,1519029559022079728,8423506247627008290,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,13531745491672407471,16280268904446236345,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,16134942850230876951,1253463305804103307,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10526707280467097257,7723769067159848537,524288 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,12847521452461142264,4406975888890023260,262144 --field-trial-handle=2228,i,17189535572968873192,10070889635927378700,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e3d07f922a4093f4838c2a952ee103e93360e6c955ec5033c32829f09e74b8a7
MD5 c798587c95e9b9b17bbd99a3443ad5fc
SHA1 06bd70caeca3f51e8ee0c5e5a76c9b5892f0835e
SHA512 cf2b62e9f786b0fae3cc81c5911ce65e3e675e1a36966576119add9005fd2cc91c31bdececb9ae1e1ba8bc7de082a5e1d56bfe3ee6d0088c4ff57ac58c81f670
TLSH
T11461E986E55101B5FBE8B033B5F057BF363849B29DEB1EAED1A4E278940E721713804C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591c39.TMP
Size 3KB
SHA256 a102f06d17b58832ff7b9553ba76280f87bc8f5dadef4c05eb501927b6fc4727
MD5 f80271bb559e8364cf5f622e3cf2d71d
SHA1 9faa260b6dc9bcc0f669a78357e6c4ce06bffa5d
SHA512 945a6c1ccc8d10846fe74705cfe88d76184cbca7502524222fe176907e534267eae4a82f84b0972a471e66df9f425a7e8b64ef7c0a2afa255e546059a8929a8d
TLSH
T1CE61FB86E55101B5FBE9B033B6F057BF367849B29DEB1EAED0A4E278950E721313804C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6afdafb9b53f5309b933a7657775dfe7c03c4b4d600e664b28b812a7da6c0c2c
MD5 a0eed469b276db1750b6e556ce8f849b
SHA1 a043dd4e05289bc8049aaf68d7bacc053d293973
SHA512 02321c735d3677f3cf0f487b4ef1b1ae6b72e474844b04306e370fac5b4dfc05b3c7e532f63de0d29724bdb59cbf11d779e8b15ee8cf623cc0c0f746c61a8ca6
TLSH
T113117DF7C3D595AE890116F05A24AE3BCE2D0605821C7C15C5D4EF2B97E3475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 09df18e538b622d6e96a6dd9b600c51f5081ab952491d9cf9c6f0d97e6039e83
MD5 d2ed8b7105c048d3f58c3579c60ff4c3
SHA1 3bd6c5a4d3ddff02fad8b0459d2c40809c157b5c
SHA512 df00ece7b84391e396f8436a8e3cbffdba52bb7d96eaf11596957fbd446701645bfd4e3cff24a62531330d8a2a16aa888f95bb19124f626e55ff1f4b3d67b1de
SSDEEP 192:sxZ1RQWf/fls68UIdpHsHW6+WNGY3XJQIg5EJ:sxZ1Zf/fls68NMHbGBa
TLSH
T14322C85A6E3869778CCBE21DBB15BF53E6F9503255901E48AAFC861C04E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 97a89c9b5a09dc912d578a2399b762e921cdc7da75d018fd3d7b18fad365e46f
MD5 2016c613bff38862a537c29d229d1bee
SHA1 60409df15f6a68441edb5b423a3516e9eb9e3441
SHA512 e8f85cbb93814fca95813eb2e7aa3fbef33ed0aca0b339c2b745db32ac62dc2bba1e8eb32b938f6c25c7c326b2667cb3dead1335c1baf293076ff51ad1c49044
SSDEEP 192:sxZ1RQWf/flsQ8UIdpdsHW6+WNGY3RJQIg5uJ:sxZ1Zf/flsQ8NyHbGhA
TLSH
T16E22D9196E38A97B8CCBE21DBB25BF43E6FD503255D41E58AAFC861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 eb79802dad351e2fa99a64b6cdb1c0773adc34933d4c4dae31eb02e5b7cf7932
MD5 0e8307f9d728f8660957b12d739928f6
SHA1 e85390b9e22b29304573d92281de227823df082c
SHA512 3d869952474a41650d24748653293d3c57af9d476b26aae69853c839ddecb5af3b1a2f351e8b154bf0f714403227202dff3227513f90ae1bf370559132ce9dda
SSDEEP 192:sxZ1RQWf/fls68UIdpdsHW6+WNGY3GJQIg5EJ:sxZ1Zf/fls68NyHbGYa
TLSH
T18E22C8596E38697B8CCBE21DBB15BF43E6FD503254901E58A6FC871C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8088cd6c9023952025efa9b54e79068e2137df4b7b533a962b0e47a0f8dd432b
MD5 cda911cad673bcc57c8d0093ff61b4ce
SHA1 5882a35810dbc40902021ce6ae1f3ef51d7579c0
SHA512 283447c19fd99dc0e2ddf56d59cd7b4954d83f630e6275340b74d7d1dcb09c3fd9901df9d3e31463e89220044b3eb04095541df3a51d2ef9228401589330ea9d
SSDEEP 768:Vf30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72nrolZMa1:Vf30AbSWvS2l9u1jaLmLZ120F1
TLSH
T1A8C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c97d1b3c3d620d0276385e9036f7c1bcc689e044e4414997ad051ed612ff7125
MD5 5d1e2e56e9d6e4fefba82ae532191de4
SHA1 6fe7479bb794f657a57d58227b1b4676413c76f1
SHA512 80893111ec4d96d428d0ff1d76d6fb74883378582d7f2616209c4322c29bf3e51709bfceb8e8f68e1c9a4eb57e157d0b70f93b0d99fdcbf7aba27406fb5fc8a4
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL2xMwuUUNb4PgISINK9s1uNxmdYHYUD:KoZeK6kyeFGK20BeoKDCGOnEj39hNgz
TLSH
T1DE91420236BB125039BD295C84E5876F524232733068EE6B7FBC50B55E6BE260CFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

febc1523-188c-411d-9e8e-14e69184ef07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\febc1523-188c-411d-9e8e-14e69184ef07.tmp
Size 9KB
SHA256 c148490482aafe6e8ab44f6acd8228dccde6586fe70fc2badc2aacd37e9d40d9
MD5 f460234cc423c2e5c798758a90927cad
SHA1 32d101251b353cc61b3ba3e60486d26bd01abfab
SHA512 8b3e671280b4c8c8e8bcd88461d2adc322f6405818815d43eaf7b21411f13305a315ae416cb538ebf76928330f457d5de24d4e161b7aab58df17111b9d72fe52
SSDEEP 192:sxZ1RQWf/flsx8UIdpdsHW6+WNGY3RJQIgrJ:sxZ1Zf/flsx8NyHbGh9
TLSH
T1B222C9156E38A97B8CCBE21DBB25BF43E6FD503255D41E58AAFC861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c68f6fc8-d507-4d1a-87f9-0da37859d583.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c68f6fc8-d507-4d1a-87f9-0da37859d583.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 035ebd65c43e5ed1c18822f9265ab13c0f57903c46bbb9be47ed53b7dbd7879d
MD5 d23e4843c57ecfd837d23e0a57c09a57
SHA1 23c0c8fa89f9d2cec58a038e5b2a8ad897c5e210
SHA512 d7bcc56b41f9305496b17b60d1d826b909027e10f459f7a389f8693c9422e88a431e8afb420775f64f5d1993d1662fe1f727a0b1af5ec19eb58edc2816d6df0e
SSDEEP 384:dZcIhsNseChpu0qPM9iX5FQCa9tgOIwZOypMoi:FhrhmIacF9XszV
TLSH
T1B5827D3A98B85C7B6DEBE545B58B36034FB8C15BEBC86F84D8EC571D01D6298030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 7a727bf9a413b0b98620478de63b9ca7087b63da4e66c4c5c277f59123842ebc
MD5 fc41f35f2849f09603ad508692287fd7
SHA1 e8202c238e9b3ab51daeb4b0570a83d579a89045
SHA512 e8d501279f7936eff32c89abca56ce8714093914a296dd746753dfe4db185a0e9edc6bb3f066c1c327f6d936d9563d9a064a50673af38e2d84b28f5a1faf5b84
SSDEEP 384:abiFiZcI0zsNk8TUNTUlIlXChpu0qPM9iX5FQCb9tgOIwZOypMoi:a2FQI1wg0hmIac+9XszV
TLSH
T17CA26C3798A88D7FADFB9A45F58A36038EB48167DAC4EF90E6DC5A1D01D71D8030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 de6be61166e7d4a82878cb6a06a03ba075b8a5b4b5219616e21988145d644798
MD5 173af7fc59257b0b6b24f7a7707ec0fd
SHA1 abb82576eddf77adcaa655a2e1676af2a54288bf
SHA512 86a412eb4afbf1c9b246eeb3682b7f3ce9b21120ff4fabb343982288475f796ee51985dc2243dbb1dd30437957a756df6b719f5dc2bcbcebbe19a261b8f702c5
SSDEEP 192:LONd6AmwpPQmiUyGCrcsiX5FQVQolRdr/rU6:LONd6ipRr+csiX5FQCS9U6
TLSH
T1A6121A3AF8786C3B5ED2A955B48B35134EE98217EF887F84D9EC171C05DB29C530B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0f3acef058d1128d7f945850af4f305a17261aacd9b64c7cf148842439792156
MD5 253046fdea9876e07cef3d64b67f43c1
SHA1 b4cec05c708817b0885dac3ad2cc6ebc29dd036a
SHA512 7acb0586c0a0b6d03c59c7a097a7fbe43c117ecb7c06f218979dfa61f3f2dc27420361cf199ab091be1d8ac9308513a2ae3c67e57093067f2c90f2495a2d240f
SSDEEP 384:fZcIhsNsXChpu0qPM9iX5FQCa9tgOIwZOypMoi:3hOhmIacF9XszV
TLSH
T16D828E3A98B85C7B6DEBE545B58B36034FB8C11BDBC86F84D8EC571D01D6298030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c91a24cd0a3595fc2985b89c94ae86ee9ac5ef696df5a3a0c5b8d74f1c2e3091
MD5 4edcd7341ef133222240f725f0fe50b4
SHA1 e66888d0fdbdded8661c517411f27a1d8a1f648c
SHA512 0d396ec6d56f98db4eed920eb0ad09f82c00bee8093a3ef545cc809ceb22b1ddb675272e566ce14ee12b96e4fcd33448f3c627e1d8002222be826be25c014bd7
SSDEEP 96:gqONkBQsjpfuMVwptaL5ih/cIPURHl8h4otop5diCDVBIPuva6zx8X5Fxkx4AVZT:LONV6AmwprQmiUy3r6siX5FQVZJiALU6
TLSH
T1DD02FA39EC786C7B9EE2AE05B48B36135FE5116BEA942F84C9E81B1C01D729C1307933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42667c23-05c1-473a-a304-1b55839400e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42667c23-05c1-473a-a304-1b55839400e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4e04fe6a788b7428dafaa8fb651257b0261bf8a123b5351411ab2bf4ab81b677
MD5 0a1210621e889a87b6f974691f84c9f6
SHA1 a9ee5784f4281dab421cbff031360f3250cd893b
SHA512 ada5677bf92694a54eb10e0e4cc9f64c0d33daaa5943e35e68a2f0eb340d98ff97f9ec5c359db8746da1f7f9aba35daf82ab51d82535b2b5143381b0e5a23a50
TLSH
T163411858A6FA1104B3B76E569FF6A86D487ABD772E06945D50010E4E4A23B00CCB1B33
MD5 SHA1 SHA512 TLSH

Submit Download