hxxp://45[.]194[.]92[.]80/meerai

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://45.194.92.80/meerai
Sample260910-hdkt7azclf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3348	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334958409119480"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{2F308556-23EF-40F3-ABB5-171B2AED2AA7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
852	msedge.exe
852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 2716	4104	msedge.exe	86
PID 4104 wrote to memory of 3348	4104	msedge.exe	87
PID 4104 wrote to memory of 1160	4104	msedge.exe	88
PID 4104 wrote to memory of 1160	4104	msedge.exe	88
PID 4104 wrote to memory of 1160	4104	msedge.exe	88
PID 4104 wrote to memory of 3412	4104	msedge.exe	90
PID 4104 wrote to memory of 3412	4104	msedge.exe	90
PID 4104 wrote to memory of 2744	4104	msedge.exe	91
PID 4104 wrote to memory of 3324	4104	msedge.exe	92
PID 4104 wrote to memory of 2744	4104	msedge.exe	91
PID 4104 wrote to memory of 2744	4104	msedge.exe	91
PID 4104 wrote to memory of 3324	4104	msedge.exe	92
PID 4104 wrote to memory of 3324	4104	msedge.exe	92
PID 4104 wrote to memory of 804	4104	msedge.exe	93
PID 4104 wrote to memory of 884	4104	msedge.exe	94
PID 4104 wrote to memory of 804	4104	msedge.exe	93
PID 4104 wrote to memory of 804	4104	msedge.exe	93
PID 4104 wrote to memory of 884	4104	msedge.exe	94
PID 4104 wrote to memory of 884	4104	msedge.exe	94
PID 4104 wrote to memory of 2236	4104	msedge.exe	99
PID 4104 wrote to memory of 2236	4104	msedge.exe	99
PID 4104 wrote to memory of 776	4104	msedge.exe	100
PID 4104 wrote to memory of 776	4104	msedge.exe	100
PID 4104 wrote to memory of 4332	4104	msedge.exe	101
PID 4104 wrote to memory of 1304	4104	msedge.exe	102
PID 4104 wrote to memory of 1304	4104	msedge.exe	102
PID 4104 wrote to memory of 1304	4104	msedge.exe	102
PID 4104 wrote to memory of 4332	4104	msedge.exe	101
PID 4104 wrote to memory of 4448	4104	msedge.exe	103
PID 4104 wrote to memory of 1120	4104	msedge.exe	105
PID 4104 wrote to memory of 964	4104	msedge.exe	108
PID 4104 wrote to memory of 640	4104	msedge.exe	109
PID 4104 wrote to memory of 4464	4104	msedge.exe	110
PID 4104 wrote to memory of 3304	4104	msedge.exe	117
PID 4104 wrote to memory of 3304	4104	msedge.exe	117
PID 4104 wrote to memory of 4840	4104	msedge.exe	118
PID 4104 wrote to memory of 4840	4104	msedge.exe	118
PID 4104 wrote to memory of 852	4104	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://45.194.92.80/meerai
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,3457725023975633780,9415349576502256743,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8102978647222098155,9429630730679918768,262144 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,9623550539687808991,10985361504033999383,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16467898080818368305,977661875202978499,2097152 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15115493573294582211,5938118638663440309,2097152 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,10850180418341595625,9207633204354319286,2097152 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,8184439676711885777,14097563467482018604,2097152 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,7876450590440383277,11864202079707249374,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,212844933335697067,4392355628348255341,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,12765490645295507979,3797323627895205998,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5664,i,15438953847305541649,16855748557578844822,2097152 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14808712087926602526,1208905570248569101,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2627211722613125567,8480030001117828226,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2627211722613125567,8480030001117828226,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,11331947521272639467,70570628716580574,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,59869833231443274,5257703016382807146,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,10949470329777553506,10129786954482476866,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,12693430245948126959,10992207899225674215,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11692169151183879267,16216134904132314216,524288 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=656,i,3603919085559730804,5324958373435042266,262144 --field-trial-handle=2284,i,10501925896044116931,4709465329941648629,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4c9bca7c75d8d5971800a16b9bd6f4eb767e56b08ad489ff7074d966a55a5f77
MD5 7b27285d32f6354009f2b91165b35328
SHA1 51941ed9e74c07cad17422a58252baec3aa7ef79
SHA512 02c4dcd78e897f73bf3a9efb0dd8cc89ba04e1e285d9f67cfe524058a4b979414fbf1336a082a5bb6a1136220282d06d4592be324f129531e4b062c6e90d764f
TLSH
T142710A3806964DECF35D033E5CF2065674B589E8F423EEFA3160E874E929F106619DB9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0c2b7b9867ecdeef12ea4992415b242df10af87987edacbc6203471afdf81551
MD5 e2c41607b1d1049cdd6f05d9fe247236
SHA1 44c82d49001fb99f70525eb7b51f619add0ca0ef
SHA512 b41b871035f33b90cc9eaf892b5ce150694fea046d707ff866d20c4756f764e47fe1cfbf561030416e7f9da97057a51f2fc6b88b1a78da0e7c7834c50c892f73
TLSH
T1A9119BB3C7D585AE890516F05A24AE2BCE2D050142187C1589D4FF2793E3065E00155B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 292e5eaed08f398201c4087a0c71be5805b73bf32f755cf18ab82b87a62291d5
MD5 4561a98c40ccbe75096595534eb380fd
SHA1 7b4e3c91c43cd86647e44cda888ac633b051904c
SHA512 ac730f4895111c3cf43408c6b0728a6f798db53203a15e8c127421c2b05d21b329522e7cebb1697387fa7f04b9af9d27108b134a1cd046b4f61e987a5572c9ba
SSDEEP 192:sxZ7ROyM/jK1Ml8Mnl/fdsNNIdpJH2N6+WNGYCIsTufRIgrJ:sxZ7ovl/fdsNuJHPG1uV9
TLSH
T17542E8116A346A77CCCBD20DFA51BF53D6F9157296940E48A9FCCA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c0ed32d9cb84e22901867fae661d55b733f14ba0bc870bf30e3f3751756247e1
MD5 9618e2b6ec0985f5dc172b021dda55f2
SHA1 1496276d03b0caf1701975e1d787642e3e4a90e5
SHA512 4b4824f091649aced73ec7cc4a7c4afa2daa773f21de97b83dc55d33b228beda8e0085e4e59e775e77d0367d7691821108dc6325e4feaa5dc31e528a87312b3d
SSDEEP 192:sxZ7ROyM/jK1Ml8UQjnl/fdshNIdpLH2N6+WNGYC/dTffRIg5nJ:sxZ7oqTl/fdshuLHPGhfVz
TLSH
T17752E715AA345A77CCDBD20DB941BF93D6F9157296900E48A9FCCA1C04F6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d9610c26d5c7ef8d2c37ef042b457c7070fe450eccb491a719013451d2461641
MD5 ca491c4b30b9e48899b12ae21134f58c
SHA1 e7fa109adea08c7f130a1c6cca5e620d5f61273e
SHA512 a4cbb8edfabfffe0c8f782c6c9b84f88fb0c1636bc08200ec02978d49c2c40bdc81237e4d8461656e8158a9bb49dc913ce5749adfea0bf0670ffe3dc7ec8f368
SSDEEP 768:er8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV5roC:er8bqn+WvSCt6u1jaCZLbWVyC
TLSH
T152D20A3B280CCB7E4F845E5DDC266F966ED801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c3a38ff31b463a372aad1490b057efad2e4f1f83a6ea108251dc1bbb60be63e2
MD5 1b392b8ae41da71ddca794cfd8914b05
SHA1 e8e7bf7cb4fa5a8d8344e2741729b35c3a891f84
SHA512 ee7d45d80b79a53661ee2d9bbc46df046d7b391492e455bed08894aedadbb3e08308489fffb88ad075dad7ce13b062176772799aff6eb6672837d96c77190713
SSDEEP 48:K4aIfK3qAry1/IxKkY87yB4InK52EZnczXx1pkz:K4aUK3qGm/KKkYii4QK52Cz
TLSH
T14091082732BB024138BD250DA2D996779E4532A33428A56F7BF820F15F6AD215CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf6b7e75-ac47-4f41-ab68-fc449303577b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cf6b7e75-ac47-4f41-ab68-fc449303577b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d955ece5c71ef043ed35161250ed8341ad316ade85f4cafe2ee4b220875752f2
MD5 5b54e908d642388c727bf66f7b1152bf
SHA1 bd94f40752453ccad9eca38f351a5e1b510b0610
SHA512 6720bd12ff036518df9a182a0c57f540d65ec0cad5f8fdeba9e1f8fb4dac6a478a4fc384f2cc2d9a34e24959afa777e1ca0768930b8a70b6bfc21b9381cc5cd4
SSDEEP 192:u2m+xasuheOwQxMGsNjGQFrF1bivGQmiU1FLw4Ea+jeOmEtmy8Hambq+qva+4Lc/:sZcIhsNjGy6q7/Ea+qOfZCZsa+VYnoB
TLSH
T186827D326D385CB659E7D385F84737138EF841679ACA6B98C5DC9F1C00DA69C130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 cd0e5f5466989a8e06214d664cc4c8ec888be393ed7a53f84a8622436fbd6396
MD5 a2e3fe2ca69d42ef0b240ab4082cbd68
SHA1 7ba3cea667d53ec92d160429ce83933e0624aeb1
SHA512 11a5d3cdcaed32fdb8bbf212bc103c6eef06da30728aba733267e175be8b4c1dc5edf6ae1901e0b68e3f3f3b3331dcf50f8c53ceb4ff3e6ac65c13b8c554dcde
SSDEEP 384:miFiZcIssN98TUNTUlIlPy6q7/Ea+qOfZbZsa+VYnoB:NFQsIwgsMafORbZhgIK
TLSH
T100A26C735D688C7BADA7CB85F94B37138EF44167C98AAA98D2C89F0C00D729C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a9aef36033117843e2d1772f4d949d25c8db03854c0706c32f55ab553c2c25d8
MD5 4433995eb24f9fecb947d9247f4f42a4
SHA1 d29556403c0d620f4e85b2e314ce93224aa9c986
SHA512 f28b127a5ea85b0e43a406b19459d8ea96d0c3937cd43553e66006079cf654b7e9b1ea392a33e802c383775f4c929a6d4e2b923695ad6b2a05bd6920cc319d55
SSDEEP 192:u9m+xasuheOwQxMGsNjPQFrF1bivGQmiU1FLw4Ea+jeOmEtmy8Hambq+qva+4Lc/:bZcIhsNjPy6q7/Ea+qOfZCZsa+VYnoB
TLSH
T12D827D326D384CB659E7D385F84737138EF881679ACA6B98C5DC9F1C00DA69C130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7b28302afafc924654f079eca8ab2c00c1bb5bac109fd5e331ca80a4f5be8e9
MD5 66580b328ede2964d59200ad1d273ebb
SHA1 820bf3eb11742e524333cee561f4ef2ed0d991ae
SHA512 58f7155a88b500b00da541621fa2a612792e54c86934721093d3df3cba21f6f754c362d668626557164ed8e512c2454391d410055b0f9931b91a7869f27924a2
SSDEEP 192:BONe6DbqQmiUy89dBa+jeOmEtmy8qNzbq+U6:BONe6uxdBa+qOfZbZU6
TLSH
T18C122832793C9C775EE29688F48736139EE4512BDA8A7B94D5CC2F1C00DB69C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e8b425f7586d1d6c58e35519ac2877e134f969d221634da2badf8311d196d86
MD5 91bfa357ac7565b02be4648ad3af8712
SHA1 d656beeeab96e5a0c1f78a9e04fc0ea3b25c9415
SHA512 2b0c00de0e195a1f5c82beac0d439c824c98cf2f20e82b4ffb95271cf4948794a34eac1835056c1c5dea47432fd3ea1cff9407b51780fc6091af2ac0db0b5f14
SSDEEP 192:vONI6Db6QmiUyZ9HBa+jeOmEtm8RgRDU6:vONI6uOHBa+qOfW5U6
TLSH
T13002F93569386CB79EB2AE49F88737275FD4203BD9562F84DAD81F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e42ed1e4-5625-41a4-b2d0-45fb4a366773.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e42ed1e4-5625-41a4-b2d0-45fb4a366773.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 af478465825218710ae3deb706d903f5d78c66fc6c3dcb95595526e2640bcd56
MD5 33fc11c2bd546eaf6f686a3e5fe2bdaa
SHA1 6726504b14d4a23f8ed56b47b70c33999cb8e5d4
SHA512 feda3eb1c5a436b6626485afb4a57c97739343d5a5c7ef89826f15e810227a7fc192a1b124da98e1aaf02a1cd2b0bb442b1562f101c7cea48c5b26ec7fd34607
TLSH
T19A410949A6E92144B3B76F5AABF6A86D48BF7C772F06D45E10110E4F0673A40C9B2733
MD5 SHA1 SHA512 TLSH

Submit Download

meerai.crdownload

Path C:\Users\Admin\Downloads\meerai.crdownload
Size 113KB
SHA256 9d3d49b7a3a228258768b02b928f41b553e135e17b40a87fb7eae87d203121df
MD5 89ea0894a01e77a0794f7fe7509f3824
SHA1 cf597d23a12b14598c4aaf7faf94612d7d9c003e
SHA512 a22fcdb0b52c81fc86e7e6e2869d70b2b06a91629ce619a74a1b947a4785da00a7d49274014fee2d88196f9690f0b7586a0373e403273ce86534b7e719ecefd3
SSDEEP 3072:zVfp+KmPmRXVjnfeRoIKQERfG8lpCG1kbp3V:F0KmPUVbfeRNEVrpCG1kd3
TLSH
T13CB33B45F9809B11D4E436B9FEBED18C33131BBCE3E97022AE105F25578A9274F7AA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download