03429415e4a3a4c6fb6f45c98bb0851848979fe7b323c50890a552fd90b64b5b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
m.meritking-resmigir.cam/index_btk_maintenance.html
Size 1KB
Sample260813-wwpsrawcja
SHA256 03429415e4a3a4c6fb6f45c98bb0851848979fe7b323c50890a552fd90b64b5b
MD5 893c808fc49b14c59d0761005e0b8b93
SHA1 0ee45c0b70fc21a12890a32d508bd2b6c5a7baf3
SHA512 e0ce0a41ffedd6b552c1b777311ee8a53bbc1f04fe298513ae2d58ab60b117d518a2812361dd14dafe0482bfe3c63768e197a46bb292b67ac51c13f3d78bd677
TLSH
T14821AD6783F084105233C6D493D64F02E4F8D91186421AA477ECCA377FF8568BA4B8A4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311187978689481"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{315534B8-4CDA-4A80-8B3A-01217A0492CC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4292	3680	msedge.exe	85
PID 3680 wrote to memory of 4232	3680	msedge.exe	87
PID 3680 wrote to memory of 3568	3680	msedge.exe	88
PID 3680 wrote to memory of 3568	3680	msedge.exe	88
PID 3680 wrote to memory of 3568	3680	msedge.exe	88
PID 3680 wrote to memory of 4552	3680	msedge.exe	89
PID 3680 wrote to memory of 4552	3680	msedge.exe	89
PID 3680 wrote to memory of 2228	3680	msedge.exe	90
PID 3680 wrote to memory of 2228	3680	msedge.exe	90
PID 3680 wrote to memory of 2188	3680	msedge.exe	91
PID 3680 wrote to memory of 2228	3680	msedge.exe	90
PID 3680 wrote to memory of 2188	3680	msedge.exe	91
PID 3680 wrote to memory of 2188	3680	msedge.exe	91
PID 3680 wrote to memory of 4668	3680	msedge.exe	92
PID 3680 wrote to memory of 4668	3680	msedge.exe	92
PID 3680 wrote to memory of 4668	3680	msedge.exe	92
PID 3680 wrote to memory of 3160	3680	msedge.exe	93
PID 3680 wrote to memory of 3160	3680	msedge.exe	93
PID 3680 wrote to memory of 3160	3680	msedge.exe	93
PID 3680 wrote to memory of 4404	3680	msedge.exe	96
PID 3680 wrote to memory of 3024	3680	msedge.exe	97
PID 3680 wrote to memory of 4404	3680	msedge.exe	96
PID 3680 wrote to memory of 3024	3680	msedge.exe	97
PID 3680 wrote to memory of 4204	3680	msedge.exe	100
PID 3680 wrote to memory of 2824	3680	msedge.exe	104
PID 3680 wrote to memory of 3808	3680	msedge.exe	105
PID 3680 wrote to memory of 2612	3680	msedge.exe	106
PID 3680 wrote to memory of 1412	3680	msedge.exe	111
PID 3680 wrote to memory of 1412	3680	msedge.exe	111
PID 3680 wrote to memory of 3320	3680	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\m.meritking-resmigir.cam\index_btk_maintenance.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbd950c188,0x7ffbd950c194,0x7ffbd950c1a0
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,18284608572128836392,7807477324169739330,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4452705453329195483,13973465128936410758,262144 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,16841658787394186446,11650298801682784517,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15994242239669395649,1731930594229708354,2097152 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10412806971654377222,13586384428795334273,2097152 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9245709442749283507,7748892736832994645,2097152 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,5403533323975307935,4799152847932172908,2097152 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7778746553334283821,4500209467449971078,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,13786984910101384526,7530783755834953123,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,17487801642245692536,3427701866769287624,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,17487801642245692536,3427701866769287624,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,9333508243499280901,11931241889791343642,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,10210730837452848132,11936280565854424069,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,15407908997465555559,7433560254090758853,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15338406481814502419,2413433216032380326,524288 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5216,i,16955882635566549850,10307681302701604812,262144 --field-trial-handle=2488,i,17998619122432926558,15170612012694394996,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 58c08826f84acc370822022d9a4714e44142bc1798c89acac2526c4731d034dc
MD5 6344e667483f61606b132cb30d09dfdc
SHA1 76c9469f15ec1e31b17a57e15aa0b5bd025607be
SHA512 8d978eabbc0a24d0567b5fc02dbb697549f7b28538ae11decb825f062a3e8993f7f0e2a0d4133cad9b50e4d67b1936f020870d6f5817d132fdb0f9c2f6573a93
TLSH
T14241E7F002A35B41EF3016B190F01B01367A83DDF9737E18829299BE3A3AF63852647D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1045b0c02dba9b8c628892a519d0c0512f272697f31e078586332ec057e732ee
MD5 fcd02f7522c42b144a23c208d371adb6
SHA1 71f6a540e9d9272cadf8a65bbf559b0906053537
SHA512 1fa7afe82f96943db0d256d5cd1a2f7b073bbbfb6db2b87f41da0a25dbde94b91a36836398c0aaa047ce3b3c3bde1ce3cd8ad8f03772d8a918677c554a5ef7ba
TLSH
T10C31ACF7C3D4866E8C1156F19A25AE2BCE1D091782283C16C9E4EF5B93F2471D20269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5aad3745a474a9986336756a7a0ddd775feff1b626d85f498e8444001a736b01
MD5 9726a839f24448a7690b46f5fdad0ce6
SHA1 8cd646d1f1947995bc12e56ef608101f5d5b58be
SHA512 52101690151b5800e87cc890679f1736264ada16bf2632b88b3c65e0a998bda62012a05e866191240219b9de7881ddb1e4e95f104de2d5fd9f678bd9fb8aa0da
SSDEEP 192:sxZVREkd/fDsxZi5zIdpdkHW6+WNGY9IKJV8IgrJ:sxZVRd/fDsxZiGSHbG39
TLSH
T1F422B8126E38A5778CC7E209BA55BF13E6F95031A1941E58EAFC861C05E7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e966fae06f6a1f3b229462dabc3bcabdd5f7b41ec921961ab54b39dbd1a2198c
MD5 b92b418ec728ab134fd4370e78348750
SHA1 539b44d0a67dc7a24e92d74e24bd1421d5016f10
SHA512 b6f51479b4ebf5f2351c5f86e41046f4519d6ef0ceb8de6f7c93717d0b076f5f46fa3280fa04187b73b431547f6a5aa36a6f93af2d43253a7fe9077736fa2f9f
SSDEEP 192:sxZVREkd/fDshZi5zIdpdkHW6+WNGY9IKJV8Ig58J:sxZVRd/fDshZiGSHbG3q
TLSH
T18C22C8126E38A57B8CC7E209BB55BF13E6F95031A1941E58EAFC861C05E7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ae7bdf2d6ff6d8cab13e99fec6a9a5196b19cda69c634217d93162f146ab116d
MD5 8500278a9278b893e973b72b08975737
SHA1 e71228d18d59a15230d22fb3885341e5ecfa962d
SHA512 712f76becbcdbf3f4922a83c51a40df3327125bdbd1495c2a4bf28e1ebed15fa76d044306b60be3f63c1fae7705fe24696492fe7b5e6c186eae97fa6b4fcc061
SSDEEP 192:sxZVREkd/fDshKi5zIdpdkHW6+WNGY9IMPV8Ig5uJ:sxZVRd/fDshKiGSHbG54
TLSH
T1F322C8126E28A9778CC7E209BB55BF13E6F55072A1951E48AAFC861C05F7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 86622253177c38b7f42af0ea38eb67105047aef5bdc96111b1104f04db1fae47
MD5 7fd5559df7d15f7609117afc04ebe7d5
SHA1 99a479ac1aba507fa56c5bd515bf961dd4e2ba0a
SHA512 d3ce4ae6fcea072b4f93a808211b39b7b548641f268c06d4a4f3a0366bc20404e822b804c4348caa5715a610b960dc42952ab73d1d5a13217e28f440d89fb386
SSDEEP 768:VfyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7aro1ybqS:VfyvIZwWvu+Q+u1jamFLeR7R1yn
TLSH
T1AEC2E92B240CCB7E5F801E9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d4ac362e2b8fe0511a470d501858254441621382a48f0d8fcf5e89e688378afe
MD5 058b04d3265b6920a26f71f0004845c5
SHA1 f531f6d8af911819a6eb8715e775ee7602eaeda5
SHA512 4617f40dbe4319d0715ff549d1ce5b75dda635ca02e57bc9abb9c962770a875fb5a9b315ec4fdb608f5a399c624cf5b57518e4b75de3e33c471fc30a5b2e5c1b
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFak:mTXjiVoZFf7Xe76B9hB53ulFaf8
TLSH
T1E7A11502713A02D33DBF691DA2A699368E4131637618E96F7FB900A58F27E111DFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5eb0111c2b4f1feece78ff0e06752ccabf8270881ab38dfe9f8de352310eb17b
MD5 3927196065872dc62b4e475072dfc936
SHA1 0367efb15b129ec9c0c20f3f19ee7443d236e8d7
SHA512 bfba0cc8af2e37d72f109781446f948da60e39325edf25a6694888f8f4b6202a3a699cad25f6f9f8bbbbaa5941601dae8df6359b199d81c89525dfd92a8ea2ae
SSDEEP 384:ZZcIhsNlVgO5ioziN9/due+CndHeReBDOOPrXLpe8C/3y5:xhWHy/LfEuDOi9Poy5
TLSH
T1A4927E31A83C6CA7AEF6A941F48636035EFC9573F6C53F84B5ECDB0D02DA6980316825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d001febb8341c4057b5687cfa52f539cf4795f33fbccff0affc40053e93a0dde
MD5 ee0a59a2126e46a3dfbc58cffe3c5558
SHA1 29e5a940d6f9266a8bc414ca6e7aa3995faee85a
SHA512 e6d2af774ad1145365ecbc06bd0b8db55bbc1b88083ede46634b04ecbe8cd875ed71fc545d6b1a15b950ce120dedf6e1905eb5b685135118e7d4cb8752ec5b51
SSDEEP 192:JONii6v+YLNQmiUycBZh+CGp+Fdes9odusgPU6:JONii6vz/vZh+CndHe96U6
TLSH
T13C02F935AD382C6B9FF2AE45F5873A135FA81177EA963F80D9E81E1C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 552dcfdb71838bd6b0a762c9680bbc9278b544ee0b24d54e42d3cee007513e87
MD5 c8e281af9c86729e8d89a6a40a9c4030
SHA1 335cb52b293fa4a38810ee13ff0f71b52c25bf54
SHA512 44f63208fbd80dbcfd0a1c197511dc2f2511d02be894d49bf87658c5584bf1301467a7dc06720da8905170f803bd58855ca412ebf4d05b050b9375b757751d32
SSDEEP 384:JZcIhsNlkgO5ioziN9/due+CndHeReBDOOPrXLpe8C/3y5:BhhHy/LfEuDOi9Poy5
TLSH
T1A8928E30A83C6D67AEF6A941F48636035EFC9573F6C53F84B5ECDB0D02DA6980316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 47986899987e400ceb54668fc489fe807511ee58d9dbbf894c53217b151e7d05
MD5 6a584219a2d60ce5499da32bdc4ef095
SHA1 85976ed4ddba0c6038fd913f8e1df235187a6746
SHA512 78696c453b6f89c9a98b69bf2cc592ee1afeb5ea862471867bb623e7767c1621bcbd40e6d0d5c6edb396ea8f231a470d4f85a73fb06dbaeaa6663f2f21314fda
SSDEEP 384:/SZcI3sNlkgO5ioziN9/due+CndHeRecDOOPrXLpe8C/3y5:/g3hHy/LfENDOi9Poy5
TLSH
T1B0928E30A8386C67AEF6AA45F48636035EFC8573F6C53F44B5EDDB0D06DA6980306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ab1f69c897ea920445f1fd664bf63e6216784e94b91c01911c8e04bbaad293d
MD5 6312b59bfd9e671b95a901f126b430c0
SHA1 cb4a19b6621579aacc627e7dcd32ef4dad96b1b6
SHA512 67dcd729a3f9deb50e4268b6176a8c4b20746c23258a2b9df6fa3a60f18c07384cd52a7403dedb0a7a002eaa4044f9d2259b3215fd33ebfff49055ec997ffa66
SSDEEP 192:jON46v+YL6QmiUyVBgh+CGp+Fdes9omOQNxCHrqdGU6:jON46vzCogh+CndHeRe2DU6
TLSH
T10F121C35A8786C6B9FE36541F08739135EA85277EE863F80E9EC6F1C02EF69C1306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10cce795-b3b7-4db1-9459-674ee8582d68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\10cce795-b3b7-4db1-9459-674ee8582d68.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 378dbeae516bcb9366f20d01c6b97b6eaf1b301222e646b6a716d9061d50d17e
MD5 d347414cb440788c7387781d867727a5
SHA1 661c4ac60b26c9f3df4ff5095af49dd57282c2ae
SHA512 9050fa1d73751f9d1abd638e46433978e8967f782e3dbb70abd54ef1ee307b6adf037f6d4d38493ca608e43b4c917318e74a3422bb924c46c78672b1709772f3
TLSH
T157411A59A6FA1148B3B77E1AABF7A86D447F79232F0AE4AD10110D4F0632A40D871737
MD5 SHA1 SHA512 TLSH

Submit Download