de1c94cb6b54002ac871f0164390e583bb88e01f27d0b1f881cb62efa2ff5098

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ci4_payroll/app/Views/errors/html/error_404.html
Size 2KB
Sample260925-wp71rashpc
SHA256 de1c94cb6b54002ac871f0164390e583bb88e01f27d0b1f881cb62efa2ff5098
MD5 f5858c2fb0c9723b8ace5c6e7f025311
SHA1 d284591bd9767bae5176940af2a47f443464c982
SHA512 481efed053c2bdca9a9235ff3f1105db9c1fa2bb5e204d6571c41c9c3cc917f2f5e72b6e01c63b65d835e3fcebc5cce8f2cf7745079dabeedddeeffe34eac385
TLSH
T16A41005E4AB306406853E4E13BE193843566520F980BC91D3FCEB350CF4D668A9D3B8C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{9AC5701F-F787-43AD-BEC8-5DC969B9A702}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4708	3416	msedge.exe	88
PID 3416 wrote to memory of 4592	3416	msedge.exe	90
PID 3416 wrote to memory of 1244	3416	msedge.exe	89
PID 3416 wrote to memory of 4592	3416	msedge.exe	90
PID 3416 wrote to memory of 4592	3416	msedge.exe	90
PID 3416 wrote to memory of 2504	3416	msedge.exe	91
PID 3416 wrote to memory of 2504	3416	msedge.exe	91
PID 3416 wrote to memory of 5452	3416	msedge.exe	93
PID 3416 wrote to memory of 5452	3416	msedge.exe	93
PID 3416 wrote to memory of 5452	3416	msedge.exe	93
PID 3416 wrote to memory of 4384	3416	msedge.exe	94
PID 3416 wrote to memory of 4384	3416	msedge.exe	94
PID 3416 wrote to memory of 4384	3416	msedge.exe	94
PID 3416 wrote to memory of 4436	3416	msedge.exe	95
PID 3416 wrote to memory of 4436	3416	msedge.exe	95
PID 3416 wrote to memory of 4436	3416	msedge.exe	95
PID 3416 wrote to memory of 2160	3416	msedge.exe	96
PID 3416 wrote to memory of 2160	3416	msedge.exe	96
PID 3416 wrote to memory of 2160	3416	msedge.exe	96
PID 3416 wrote to memory of 4432	3416	msedge.exe	98
PID 3416 wrote to memory of 1184	3416	msedge.exe	99
PID 3416 wrote to memory of 4432	3416	msedge.exe	98
PID 3416 wrote to memory of 1184	3416	msedge.exe	99
PID 3416 wrote to memory of 2964	3416	msedge.exe	101
PID 3416 wrote to memory of 2932	3416	msedge.exe	105
PID 3416 wrote to memory of 4892	3416	msedge.exe	106
PID 3416 wrote to memory of 5100	3416	msedge.exe	107
PID 3416 wrote to memory of 3544	3416	msedge.exe	108
PID 3416 wrote to memory of 3544	3416	msedge.exe	108
PID 3416 wrote to memory of 3684	3416	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ci4_payroll\app\Views\errors\html\error_404.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff98905c188,0x7ff98905c194,0x7ff98905c1a0
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,7463706262564634628,13459927404314958057,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,2814729729847857911,5011042990102045568,262144 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,815636397981335977,10093038489978702120,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,1059118803961258251,6187045657279892527,2097152 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,702054679295399736,3410135279956903906,2097152 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,164645486750816780,12371204021047017336,2097152 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,10699254517198380081,11318191646337118415,2097152 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,11223393904786447322,934804047987513886,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,10556310854674288059,2630469270067746508,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14547487537375720820,2716056598020259657,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14547487537375720820,2716056598020259657,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,15958498454529126779,2937941640237695324,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,10649769547560641031,11975021011939038950,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,3990154117011619628,13653026913700524035,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1183787926289568805,10090803644165690366,524288 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,1396792751185302069,16070964023549692132,262144 --field-trial-handle=2308,i,14037245497439246693,5943580745641062445,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 04f2879b99ca17f4bd4082202626cfcaf033c88c0a6c6947bc0190f3dc585901
MD5 8d674d6e53403a4d2303116feb5b2d6a
SHA1 cb4ab462847c31aea97f6372e67d7491f1ded44b
SHA512 97276b055a0a5f141253efcb050ec393b1760c4b9e08aa5b9569d1a8ad251559b9ea1c015a860822db01ba4755f5787da6bd5f395bd3514d52ecce646021d6b7
TLSH
T1E551A6D161598A9CC7B8E471C1D14243FDFF26F0A74B9F1128B6C2B66BC63E46325841
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a903b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a903b.TMP
Size 2KB
SHA256 6937d02acbd1ecdb4c15c2c40f0e22aaf5de37fe64b4f48b2a1a277d716e3053
MD5 c1fe38bd9236b64721b25e4bac4abe27
SHA1 7c19aaf67f7c576d2d09dbb4af23c3457cd2f0ae
SHA512 b17d56a41d140f3f4e5596a1a50857f82fc79e227c37b74fe10821b231fccb7eff4092f26599f9ddd3cc216cc06637cb453c2deb096bc5c9770222539062eba8
TLSH
T1CD51A6D161598A9CC7B8E471C1D14283FDFF26F0A74B9F1238BAC2B66BC63E46325841
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7e9d03e5c8184ee7eb9cddb089843aa94ddc2f67748cc79a7201e0d975a3fec9
MD5 482055360c9887b5539abea8cbd2bdf0
SHA1 36ed12b7dde624c3db0040fd372aa0728f6c68d7
SHA512 b5d63eefc84f2bff77dd1ef185c81ed8728f05f0e109da0da82c307bd351e86ec3a785d11228561791ec80f54b7bf761d2b309eabaae5f0aa762347a4fad78fb
TLSH
T1BF41B0F7C3E8867D890156F4AB186E2BCE2D0955832C3C5AC8D4AF2B93E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4013a7df903c3572128294cfc945733406afc28f74dc3d0a1c340ba3d789933d
MD5 c685b3eb9f69c2cc8770099a20e03181
SHA1 3d7a03b9261134af50e28b809f998e4df8c3da3d
SHA512 cee7dc00d975865ea00daae88847c2e0847822f5f8f3106709fd86edc63279e0c44a1661b112cfbe08f9170f73f36a37c08db1fa63a9dcdd619239389ab0281f
SSDEEP 192:sxRzR2fbU/fTsEK7xoQzoA8p4e/g6+WNIYD9uGkIgDdJ:sxRz4U/fTsE6Kj/5IFz
TLSH
T17A32A719AD28A93B8CDBE21DBB55BF53D2FD503360915F48A6FC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 040bec824a2ecfb96a6e1647c8ceea1833361a812e6fb090bb9fb4d90cd635b5
MD5 ef47743406754995e33ffc3b42d93cf2
SHA1 0c33c52fccd52c4cf1b34245befde017c0276e6c
SHA512 591a692ab669245594a300f9bdf01048a805f8fba62bf1ca6d8d55e710aff7c5b992fd4fbf968a35e58d02d5f6ce3312cb1f3c7d370c5797d9b12dc304be5aa3
SSDEEP 192:sxRMR2fbU/fTsQK7xoQzoA8p4e/g6+WNIYDFuGkIgIJ:sxRM4U/fTsQ6Kj/5Ibs
TLSH
T16832A819AD68A93B4CCBE21DBB55BF53D2FD503360945E58E6FC861C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5df8628e4ce1519364d089522f1d66da6f8b7a541ed09b111f2f20c522c3eac3
MD5 2725e75be8e12713074b3522f0ff6a7e
SHA1 4b2d8d8de7903c00ea8aa69b39aec2e5ad9efe20
SHA512 a7da79c26068d460c46f088cd1eb9d62a6d384c89817e4e142f6dc863f96fc736eeb08002b2a48cfa645922622f9d39e6d126d9df961f9a9b7162c1a133db1d8
SSDEEP 192:sxRzR2fbU/fTsyK7xoQzoA8p4e/g6+WNIYDFuGkIgDLJ:sxRz4U/fTsy6Kj/5IbZ
TLSH
T1BA32A719AD68A93B8CCBE21DBB55BF53D2FD5033A0945F58A6FC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 536c59bb3dbf59940d1419bb04fb50426b642d072de9218489004e4e9d569737
MD5 449f22e606cef12a69a9085eb5c53fe2
SHA1 53d5249434a1a2b42ed426621ec3171dbfb641f3
SHA512 51dae382624b4307dcda9d734e9ba5da969d7a0e7cb4bd80a803f1990c9cc83e5c1432c9b797958ab7d1d22ed53ecf174f297648176d2fa3c46e212c27230fbd
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9iroTyg:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0Vm
TLSH
T18BB2D92B640CC77E4F804AADAC196F977E9802C796988D4047FE995C03C77FBA11A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b29fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b29fa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 16c583d6b9b129d1f8c23db44161823c016421fe67a842b1bbf5e689ae9640e3
MD5 f68fa12c47c842863d7142c76f95dd71
SHA1 7eedbb28476abfcc8a47666dfaffb56945bdffee
SHA512 8df26776715f818ca9848cf5193aa38dd34de880cc4dc897873e4e4256829ae252cb26f1a9b94d108b62651abb1bfa46be16a83b00ffe595e90b413eb88cd407
SSDEEP 768:sb35TfmybNbLhmtHcOeRFZD1fTos7Rj12sju:sb35TuRY1fT/RZ2sju
TLSH
T109F2BF3ABCE45D735CFAE245B24676467FB451A3DACC4A8454DC5F0E05C7BAA030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1d1f6ebae6c961676ec233d45728663c68d2dc4f20ec8f9632091db83dfc9490
MD5 867bf661497d9fc5beea4ec23b5ee223
SHA1 d6b1e807e78f592d24323bde3cf5688f9630ffb8
SHA512 b5e88643dfe01d3493361c0ce7264b37ed964a2c1317925949c4743c53250af0cb6a3d4c365d5dd17a60d453198a34f30f4f428c69a0558af41e6eb4bf446b85
SSDEEP 768:ub30TEmybNbLhmtHDOeRFZD1fTos7Rj12sju:ub30TZ0Y1fT/RZ2sju
TLSH
T10AF2BF3ABCE45D735CFAE244B24676477FB451A3DACC5A8454DC6F0E05C7BAA030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 47ac1ae6b54aee8811ddb57f83a63c46414aa3ebfde928682565543c56ed9b76
MD5 b95275d3ced88ab564fb7e105a6945ea
SHA1 3441a50cd94ff04fc7713c34791d577ff7321c2e
SHA512 6c712c970d0ae38399711a94c0a285f155b12ce561333d41b57930abaf4b519777c9924507f53b85ef98946d82806b3a31b6a74c098d785d89cee2f46989fefb
SSDEEP 768:qFQN37wg9TfmybNbLhmtHwOeRFZD1fTos7Rj12sju:RN3jTuVY1fT/RZ2sju
TLSH
T13FF2AF3BACD48D779CFAD784F24A7646AFF441A3C9C99A9495DC5E0E0087AED030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ecf5352a4b1176244b6a8797c1e45a8ea1e2211372705e1ec74382c84f23000e
MD5 dd6b31e9c274b9759f0309dec20d3807
SHA1 153f124e15d7589faa1491261f59bd7a23d92a7e
SHA512 f34986a378918fefec6b1a796772f9f4344832fa8cbe2bc20716b77e46555677f1e76b93c35ba693e5660f06cfa1f8a6f3373aace88268bd9d87fa98f6d9f137
SSDEEP 768:z/UxvxjgC+k3dD4ybNbLhmtSOeRFZD1fTos7Rzb/+Pu:GZj3+k3d0TY1fT/RHKu
TLSH
T1AD03BF3AF8D86C338CF6E244720A764BBFF415B395C95A9809ED2F0E158BB9C1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7689905-794b-4679-946d-bde46cb7c0d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b7689905-794b-4679-946d-bde46cb7c0d6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download