34fe4bc0fe6d8f16a43917a9b4495f4979620c6d4d8c5a048750427806aed287

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
m.meritking-resmigir.cam/index_btk_fake.html
Size 71B
Sample260813-wwpsrawcja
SHA256 34fe4bc0fe6d8f16a43917a9b4495f4979620c6d4d8c5a048750427806aed287
MD5 a379bf8adf9d6503b6aca03203a3857d
SHA1 1aa9e3c3fca0b3eb242fb3479e4468a4908b9518
SHA512 12b89fb63499d40106c486da6ec4b10898c48d3958a06f962bd763b3bc48ea951490faa80e84db9d8b72ef55e9de35f13e1a3ca138817b61ab1bf70a6d1989ca
TLSH
T1E1A002EF0DD2E21667D2C2559933B10C51D740AB4C81D6916DC28910262A3FF8D15F9D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311186989663697"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{75409EC9-4FFD-4915-A894-007ADA2AF717}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 5032	3012	msedge.exe	83
PID 3012 wrote to memory of 4392	3012	msedge.exe	85
PID 3012 wrote to memory of 4912	3012	msedge.exe	86
PID 3012 wrote to memory of 4912	3012	msedge.exe	86
PID 3012 wrote to memory of 4912	3012	msedge.exe	86
PID 3012 wrote to memory of 4044	3012	msedge.exe	87
PID 3012 wrote to memory of 4044	3012	msedge.exe	87
PID 3012 wrote to memory of 2140	3012	msedge.exe	88
PID 3012 wrote to memory of 2140	3012	msedge.exe	88
PID 3012 wrote to memory of 2140	3012	msedge.exe	88
PID 3012 wrote to memory of 968	3012	msedge.exe	89
PID 3012 wrote to memory of 968	3012	msedge.exe	89
PID 3012 wrote to memory of 968	3012	msedge.exe	89
PID 3012 wrote to memory of 872	3012	msedge.exe	90
PID 3012 wrote to memory of 872	3012	msedge.exe	90
PID 3012 wrote to memory of 1440	3012	msedge.exe	91
PID 3012 wrote to memory of 872	3012	msedge.exe	90
PID 3012 wrote to memory of 1440	3012	msedge.exe	91
PID 3012 wrote to memory of 1440	3012	msedge.exe	91
PID 3012 wrote to memory of 5060	3012	msedge.exe	92
PID 3012 wrote to memory of 5060	3012	msedge.exe	92
PID 3012 wrote to memory of 5060	3012	msedge.exe	92
PID 3012 wrote to memory of 4724	3012	msedge.exe	97
PID 3012 wrote to memory of 2020	3012	msedge.exe	98
PID 3012 wrote to memory of 4724	3012	msedge.exe	97
PID 3012 wrote to memory of 2020	3012	msedge.exe	98
PID 3012 wrote to memory of 1548	3012	msedge.exe	100
PID 3012 wrote to memory of 2452	3012	msedge.exe	107
PID 3012 wrote to memory of 4104	3012	msedge.exe	108
PID 3012 wrote to memory of 4884	3012	msedge.exe	109
PID 3012 wrote to memory of 2604	3012	msedge.exe	111
PID 3012 wrote to memory of 2604	3012	msedge.exe	111
PID 3012 wrote to memory of 4600	3012	msedge.exe	114
PID 3012 wrote to memory of 4600	3012	msedge.exe	114
PID 3012 wrote to memory of 2492	3012	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\m.meritking-resmigir.cam\index_btk_fake.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,3789897790339345094,3916292287961853753,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,18375323451584459394,8235659779307639119,262144 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,6022491179410987304,658580719922959178,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5037193938647076278,5696159576957738829,2097152 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,2849913478950927311,15530705862034292283,2097152 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14900032232008340876,4288133330029202939,2097152 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,14675351143456118622,9906070726304923307,2097152 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3592,i,14235135773196854172,2221675642867498107,2097152 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,2321400712544410866,7930367630781250655,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,10881711810486803298,11225456047801255356,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,16657789774202670482,11671432844885595514,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,16657789774202670482,11671432844885595514,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1895381034769064179,3071330996545338005,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,5033714242759052187,14457432892720651003,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,1491892633389506866,16168029804405687689,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,7279770942976554457,15582448614558943925,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,7133586439433044198,16186197322141322578,524288 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,14032417404367592578,8907146039981867711,262144 --field-trial-handle=2088,i,2773048428025167331,796652029499816112,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7745bc8c3581dff6d03d8ed327e09cd7ec664c560e83269d4bfca316584665ef
MD5 ee35570a083085f4ef25be21f3450a6f
SHA1 1a527024297d8cac454c431c6bea460ea735dac3
SHA512 f2091d3915b21f3ffc51bc1af3cd57cbfa13c39e1aa94f5136cc612092023eebf64796abc4c5b1039e539935aadac0525c23c7f8b478b233800858669ef2af2f
TLSH
T19471513D192609A1D3A1893278CD12847DB5C9EEFE336DAE0179FA74E50D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589ad4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589ad4.TMP
Size 3KB
SHA256 8bcc29ff1075c468906a692a490eed241e7bc77b2e19b2f95cd5fc02f8ed1f22
MD5 a018e16713ace4ec74a7caf59d2d811c
SHA1 f5ff10aa020be3265541f00c54e3a9a40ba05b38
SHA512 d11682169283eedcf2e599c3411a3c6fd18c14a55c73a8835dbd1979278f62da1a83ccd6fd112a9f9edf8fb3623a74b4a38d46c6d7cc5f9420e9c8ae3d0d912d
TLSH
T1FA71413D192609A1D3A1893278CD12847DB1C9EEFE336DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 05a7a15595fe53040811b1138e6d868e7ae30e4a29ceeeff3360ef8464334b55
MD5 503a86c3018835394bd8a9d90c758908
SHA1 a2b494c420ed3105f48dba7b77a0677a3901c3b9
SHA512 5d156eb0f4d0bd46e5404196c69021766bcd2cd9a513719494075820d8cd0d2388d323eceec321d78884b874154bcc086639ca90f78364f9587470effe168e03
TLSH
T1FD3189B3C3E4C66E8C1256F09A247E2BCE2D0518861C3D1AC9D5EF5BA3E2071D10158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 00ca8afdd1490cff4b29711630b5cf6f111251ae79525e1297d04a3f5088c6ae
MD5 eeaec284d30ec4d86e05d0613665aaae
SHA1 a2913a98f19ccde70a23f1f61a7a55a3da10f6a7
SHA512 18838b6d332c019b4ae8699068c5512cf05103edd316f3fe3946a93c9548d048425af387c1c36085dda77a67c9b28e463b24684be04b923bd4a80820ab5d48cc
SSDEEP 192:sxZ9ROkU/f+xsNHQLIdpdmgHW6+WNGYIkcrUNIgrJ:sxZ9bU/f+xsNHQUZHbGPI9
TLSH
T1D622B8116E28697B4CC7E21DBB597F53E2F9107251D01E58AAFCC61C05E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b815e207ff197e6f7b9f5dcda2bbeccfc8ba9d18f0d4e481b8b7145c6d4de483
MD5 6a4606ff375b53ac18d824360ee9917a
SHA1 b49d2b91fee544a86f9d4b87740aef0ad3551175
SHA512 8a63edaa1a98019ae046b14a4d2e27600e521c7008982d4e7b4de2e820201ac36aa11756b2a85c871f8f45f04f135930db6cf5c21f0b0703acdd2c732170d0a8
SSDEEP 192:sxZ9ROkU/f+xsXHQLIdpdmgHW6+WNGYIkcrUNIg5tJ:sxZ9bU/f+xsXHQUZHbGPIl
TLSH
T1EA22A811AE28697B8CC7E21DBB55BF53E2F9507151D01E58AAFC861C05E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d22ad0a5fbec5a36b7e10e7d07cb2b38ba20cc5b4b371b80bb5730b972e3576b
MD5 9395f97a04194b5df160f31b7bce9f73
SHA1 ac8be783fbfc95a3444c337573970e1c2a24a13e
SHA512 7f2f61d40c6c1ab7d258bfbd85333de2615c0e9ee138a66be0543c499eaf1421e056a93c3044a87168450fc43a9895983b4bc9daf7eb6ded7b7970ec96910fba
SSDEEP 192:sxZ9ROkU/f+xsXqQLIdpdmgHW6+WNGYIMUrUNIg5HJ:sxZ9bU/f+xsXqQUZHbG5IL
TLSH
T16B22B811AE28697B8CC7E21DBB557F53E2F9507251D01E58AAFCCA1C05E7ADD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b3c7112becab2d654dce2f627a4772a030b9ab89e4156be85287adfab1176f04
MD5 da0d6a6edd4f1396c4ae642fd2ea7038
SHA1 fafc508326397e6300e663829f162abe892be7dd
SHA512 9ddccc7aa7fe43627d492d41adbb3c0ca0352ad5507222f64afaaa262f10a1b624eeb0b1cd1347685e9ad2168a77328d02663cd0a34df3eacf5568a51d418aa7
SSDEEP 768:r2yqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7wrorzy:r2yqbblWvJDjTu1jah4LAs7brm
TLSH
T194C20A3B654CCB7E4FC00AADED5A6FD73E9801C7A6588D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6d33c2879bb12f2708665ad22eea33c292e92755d7310b94e52bcbd20db81b86
MD5 fff9b37ac65eaead16736c750ededd01
SHA1 32f2bb3f0ac57e8a4e951930401bab451a2f0d6a
SHA512 e47a29b925e17476aacc08223638b2be48c042f457ad243bff148c2a32c9dd844695cdfc655dbe81ec90bc6fc3f3ba62217bd89eb9ed22587a540525e2784067
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLikq:KYbaKYIKOfuKQY+S2gKnK4A
TLSH
T1F1914816757E02427C7D2858B3A69A374F4532A33018A4EF3FB850A24E66E120DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a96318ce-16b3-4a95-b468-064dc05f3f55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a96318ce-16b3-4a95-b468-064dc05f3f55.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2b386f2e8b011a56b681df146da5422541710d7c9c28fd722b01c61479ab72de
MD5 253a72f092edc99050e49cc6bb67f51c
SHA1 b8ab4a798981e5eff6bda3d71c3e18e4c6a69da0
SHA512 60d58952f23272d974f11d2ca39e6339d0562d759aec1515c9bbc779132772dd171e15879432508cc66c7a8e927798622bfac144b0a5f10fdf0ba58d66b3ac8f
SSDEEP 384:EiFiZcIcsNSf8TUNTUlIlcJByrbtLoiVRNT6btDmOOPrXLpe8C/p:fFQcRwgmy9owHTmDmOi9Pi
TLSH
T1BBD23BF258E7487ADDAE9B43A77E2D035EBCC167B5846A40B3D8450CCD964BFC30A921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9bc1a9e22b725103cf2aebec4ec41c73b03ff7a50a8b6387b052b1ebb7ebb1fd
MD5 814731e382e39d1dfe9a9ff7de222c78
SHA1 caf2ec678b761e5cf18a8e850b13340c92b4db57
SHA512 1f064f317a807c6a591a2cd5cf4505c270328ca17fd16287e5d677461529503ec5ec62b81d483dbe5c82d47527bc0bc868306bfe15b612e6eeebd469eb01d87b
SSDEEP 384:CZcIhsNSFhJByrbtLViVRNT6b0DmOOPrXLpe8C/p:wh5y9VwHTNDmOi9Pi
TLSH
T1D1928D32AC385C6BADF6E941B48736035EF89167F6C42F84A1EC9B0D01DA999030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c07c81ce86d4552bfdbb5155e53f4060cbfaae6aea4e36888aae7fabd6f45e7f
MD5 5dfa212579d73d25f18d6d7d16721837
SHA1 5e162d46d1c503cd249f53b5898dbcf8ef85ce90
SHA512 73a0f95b7b1c2c11b0a990a115a0fcfd689b854bfe4863cbf72d013c59926ccf77d2f421d53cbc3a7034aae6ca86cf3e7d269f0adff070867353e1a45caf8c52
SSDEEP 192:tONb6JkRtQmiUyWKW+RNKFCk5dZDh3MREU6:tONb6UrIW+RNT6bVrU6
TLSH
T183020B35AC382C7B9EF3AD05B58737275FA4117BAA952F80DAE81E1C00D769C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71947545d102fb390829e523aa67be22c0fe8172250f78c7ea92cb981a8c5af6
MD5 814d2c288012de8b90d444e5f55b1b9f
SHA1 e11ac627fd549642a2e4bed55a718336c4578803
SHA512 836f68c684d54f60e320913a60dd99908c617b2e8cadabb1728baaae8cd875325f239aadbec6e8bce60a90ffc4241b46d8c7696719786fd8d7ca03e02574b2cf
SSDEEP 192:BONuU6JkRGQmiUy9CK++RNKFCk5dZc0vNVcfqIjmU6:BONuU6UigD++RNT6bEDmU6
TLSH
T15D120B36A8385C7F5DE2A901F4C736135FB5526BEE897F80D5DC1A1C01EF99C130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f221b9024434da83df0246c8c241f7a89c9174cbe60e6dad3db6627e10fcd20d
MD5 3853c2e9d0257688b7189d3de26ee523
SHA1 1f9abf276eed80453b67dedb65077a360bace9a6
SHA512 081b637bf3837d01a762bf3799c0eaad7b93e24233dabf27db606760297672e38a6d0bdd92fb90f869e7df73a75d69419974967ecdb591667f041393d9670f2e
SSDEEP 384:bZcIhsNSFcJByrbtLViVRNT6b0DmOOPrXLpe8C/p:Dhgy9VwHTNDmOi9Pi
TLSH
T182928D72AC385C6B9DF6F941B48736035EF89167F6C42F84A5EC9B0D01DA999030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ff2f11724370649e9f6dc82d542d4b807882996f769b6661a67b2a2ec6479c7
MD5 996dde811549e158022127073c8f0e13
SHA1 1c084dc671e60ba0071446d4c47d5f71b32f4be8
SHA512 b512a82455a07d7bf618f6ec895ed5b8d555590eed5ca8a85bedeada6fd94359b9a89d443892db01778a2d57b685eba55cac035cfe0b8bba3738b310e5c1d7f4
TLSH
T1BE410958B6F91148B3B76E5AABF2996E487AB8772E06945D10110E4F0A33B40DD71733
MD5 SHA1 SHA512 TLSH

Submit Download