2589c83f942407150ea3d21ba8c1aa1f946c806a367973ae908c251864326220

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Meritrust CU/login2.html
Size 11KB
Sample261001-ppvxvsxwft
SHA256 2589c83f942407150ea3d21ba8c1aa1f946c806a367973ae908c251864326220
MD5 4003ee7bf1fd8e825f7a9a4ade3701a0
SHA1 6e14b79ae5d4a189d001698e46bba1a30e7b51dc
SHA512 fca4ed71a30d8d4f27d91e0e79717d3aabb8cb5442268820dee9e0cc03a885250842956ae2a9a179daae98c6fc6cd6469b985fd832e2fb496fa008bb7195d074
SSDEEP 192:mfXEA+MU89vRyjTnDK4Mxl1xdREG92DwUfLcyek/+:mR+GlEGtUjcyB/+
TLSH
T1E84261A6924714026933D3A4AF63030DFB568023C30682583FEC63966F75B479963FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{2FF8A49A-0027-485F-8956-20DCF8AE753B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 1912	3900	msedge.exe	85
PID 3900 wrote to memory of 4652	3900	msedge.exe	86
PID 3900 wrote to memory of 452	3900	msedge.exe	87
PID 3900 wrote to memory of 452	3900	msedge.exe	87
PID 3900 wrote to memory of 452	3900	msedge.exe	87
PID 3900 wrote to memory of 3520	3900	msedge.exe	89
PID 3900 wrote to memory of 3520	3900	msedge.exe	89
PID 3900 wrote to memory of 2040	3900	msedge.exe	90
PID 3900 wrote to memory of 2040	3900	msedge.exe	90
PID 3900 wrote to memory of 2040	3900	msedge.exe	90
PID 3900 wrote to memory of 4104	3900	msedge.exe	91
PID 3900 wrote to memory of 4104	3900	msedge.exe	91
PID 3900 wrote to memory of 4104	3900	msedge.exe	91
PID 3900 wrote to memory of 4376	3900	msedge.exe	92
PID 3900 wrote to memory of 4376	3900	msedge.exe	92
PID 3900 wrote to memory of 4376	3900	msedge.exe	92
PID 3900 wrote to memory of 1380	3900	msedge.exe	93
PID 3900 wrote to memory of 1380	3900	msedge.exe	93
PID 3900 wrote to memory of 1380	3900	msedge.exe	93
PID 3900 wrote to memory of 372	3900	msedge.exe	97
PID 3900 wrote to memory of 2560	3900	msedge.exe	98
PID 3900 wrote to memory of 372	3900	msedge.exe	97
PID 3900 wrote to memory of 2560	3900	msedge.exe	98
PID 3900 wrote to memory of 4724	3900	msedge.exe	104
PID 3900 wrote to memory of 3756	3900	msedge.exe	113
PID 3900 wrote to memory of 4804	3900	msedge.exe	114
PID 3900 wrote to memory of 4328	3900	msedge.exe	115
PID 3900 wrote to memory of 4540	3900	msedge.exe	124
PID 3900 wrote to memory of 4540	3900	msedge.exe	124
PID 3900 wrote to memory of 4316	3900	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Meritrust CU\login2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffef25cc188,0x7ffef25cc194,0x7ffef25cc1a0
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6662760669211872872,5530963148750631453,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,8397669777389244573,16630592861425431945,262144 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,5627159465787711470,10551563222762606445,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,8488401418110953194,9037771591695962694,2097152 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2688906239534594649,10030395991130786766,2097152 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,14967972613620667249,4667211538567009524,2097152 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8509277157266750582,4926103913294798541,2097152 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13597607685303627801,14190577915731634487,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,13590134421907187203,459400781006610986,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11731557041690714019,5958294983257852831,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11731557041690714019,5958294983257852831,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,3799031653980530049,3285051696535712569,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,3566293381654638348,17702907880600233400,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14484149553653975304,4251136620887537841,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,6783095757531785355,2185061753911759054,524288 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,3090209312067378509,2886152032590414337,262144 --field-trial-handle=2276,i,6001585500403670524,17329478430373093679,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

18f048c2-1a3d-4195-b262-8c12e3ee7011.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18f048c2-1a3d-4195-b262-8c12e3ee7011.tmp
Size 9KB
SHA256 371b11620cce0c37a462cd9cba37d3d506761ea99beb9ce1bfc6418200e3d9f8
MD5 3088d6846af044b6b9c92f807a974437
SHA1 bc983f42111b8e989917e49c62d99cad627b7e3c
SHA512 ec273b1687df5450f369df887f075f72daa6e8767c028133fd631d8251cb5782565f911a0a6fbf43e830a2f168d97a7458f9233acc0b99f7a481bf218d5f3142
SSDEEP 192:sxZ5R4Wh/fHs1HIdpdcHW6+WNGYrbrDIg5SJ:sxZ5Rh/fHs1IGHbGQs
TLSH
T11522B8526E38A97B8CC7D20DFB15BF53D6F9603291951E48AAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b2b2abaa64c922a32be8d5aa0a41812e127f6e532d1e793472e1ec1b325eca5
MD5 03ed17937fcc9edaa89a04a247ceceda
SHA1 8d4ec0979c4522d8a6d3716424dabca1ac770d16
SHA512 1d931a5b035b93dfd8b3983466c218e603443f02f2f356e88851c8925b8c485f002e32b4eb93166d28de3450d8e55d987d676ddb1014dc8d315c37e763b48860
TLSH
T163612E86E48E4463DBB491FD8EE12CCB3938C6F046AB1D5A0398D8795F27F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595951.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595951.TMP
Size 3KB
SHA256 a2ec618311440f9d73e47ede9ae7550cdcdfd8550f2ba95e669ff84101083d2a
MD5 6c2506a355b31b6318c377ce50898476
SHA1 75ffdabf831cb7d49864de9dbaab46e4ac2eacff
SHA512 67adec6ce8d3b19d914b82bfb11e898c334c1854fa17550136734836d63a953a7fdba7454181d4fc248c8470280e26511d5db6dc9943dc07d746b3a40d27c4f5
TLSH
T146612E86E48E4463DBB491FD9EE12CCB3938C6F046AB1D5A0798D8795F27F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 38a27bbfd4023ddc056e37cd199986a20213f1c950369d0a026987c9f9a874d4
MD5 f878c147ce1a083d19456f87cb0f1396
SHA1 46917b874c1c3d9b1e0549faf272b1788a942234
SHA512 1288a6ba6908a42a6847397b4145a95f274c328e9908abd00504274bd2b4bff7fb786f8fc9ba4052410e7e78e483c02e68ad72479764fca2d8b0f81ad5f452bb
TLSH
T1D221CEB783E486BF890156F05A14AE2BDE1D0106432C3C2AC9E4AF2B93F3475F10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3945d4471e5fd026363e9c5ad349fdd1263694a58a3ce764d52a49fe805c9fd3
MD5 11e406dbca09beee1d4ec0551f42aea2
SHA1 65d7b002ccead676404037d22028148bea6a47dc
SHA512 1c9126970c08e89751e7711cdbbae762d56cd07f6996bcb4a1095c3a98e11f0024d512152f38d0fdf27d420654bed56b961ec95048f9c12785fb824e473fb18e
SSDEEP 192:sxZ5R4Wh/fHsQHIdpdcHW6+WNGYrbrDIgrJ:sxZ5Rh/fHsQIGHbGQ9
TLSH
T16112A8526E38A57B8CC7D20DBB19BF53D6F9603291951E58EAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 154c42b1158c69ca002f542bcc9ba511d2965b52af23f4a63cdc1082882ba4be
MD5 43ecde906b8cc5cd344fdab28dba398c
SHA1 9791a56f669745117c04d1fa859cf9c13b7e5e93
SHA512 a2e38df92a9500a0ac30f0e037696ec81081fde41dbe84997f72b883f69b886dc3d9ebf0dd5dd0a87a8904b393e9b71bfa3d1f3590ade1371da66a56702feb34
SSDEEP 192:sxZ5R4Wh/fHsQHIdpHcHW6+WNGYr8rDIg54J:sxZ5Rh/fHsQI8HbGzm
TLSH
T16922B8526E28A97B8CC7D20DFB15BF53E6F9603251951E48AAFC861C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c51fda06fcc139e656da4e04edf49a1b7bdb460af1545ecf2531f08b490b75e8
MD5 f466f39ad23184625a5aa452e0e30799
SHA1 8b7dbf770817328657fee0c4b1ac5e8129b5beec
SHA512 c58b03368acb968ed18caa806e1d1de4e2c254fb0b02f35c6be21e965321a94f74c1f8501e10854a3e9e0ec8de81cbb68951e1c31dd832e762595423682271ff
SSDEEP 192:sxZ5R4Wh/fHsQHIdpdcHW6+WNGYrirDIg54J:sxZ5Rh/fHsQIGHbGBm
TLSH
T1AE22B8526E28A97B8CC7D20DBB15BF53E6F9603251951E48AAFC861C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 158ea6ce63c0c0b6f09cbb0326922ee565c72c497d45c486bb1aafc8daf3f8d2
MD5 bbcd02dabf7fe1301ff72fac80a8c90e
SHA1 8ec843b8c3ecb50507988512ffd16c2636424163
SHA512 933c4f2ebb7fa9fdae938afe5db2ffbb05ff4c0e85479a981bdc27927bd955faf81640d5fa8595a52a1841de6857d943aad7eabcb175c2ccabf26a5704c8abf7
SSDEEP 768:UNy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbProR3E:UNy4J/DWvbtBhu1jajiLm0bc5E
TLSH
T191C2FB3B644CCA7E4FC00A9DED5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a95c21cfee407eeca1586a2a6c33a1d2dfce4cf1439962448d0e90ce7ec65b15
MD5 da4d85fff7457960177c1c702b77b61e
SHA1 7bc41776b89ea61794a187ebe2afa8cda5650953
SHA512 fea69cb7205afd047eae4dcd39fb17ca06381efc323a72fe32cbe048ae546c0b4292ef04302616b583fbb44feed76bfd9f6109d8bd9dcf986df32e4ecab2547d
SSDEEP 48:KIDI1Ks04jyL10JF3jXYbLuLISPRIZKSsErytZIhKqkl:KIDCKs0+iSBRmKSsKOZmKqkl
TLSH
T1E2918111B06B03D038BE3E484075D65A4B5236B73229E56F7BBC85A24E6BE106DFC9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6116b02d-ebc1-4396-a726-77a394fb1a00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6116b02d-ebc1-4396-a726-77a394fb1a00.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c7affc7ecca4653013a2f46e958982176272fb0cf7d03a3977b9950960cdfbb4
MD5 07bff7e73b0aef9c15ba2573ca2c821b
SHA1 767b6dc9d3d4679f19ecc83c7c946d6d30e48484
SHA512 a657db24995c24b1c1ecf0754c952a95e698d275ff9f08a1c52586a34da78eb93e51dabae122b2c1c6dfd9de5c342d762f922833ef1cfc9fcb9479839fd5f22e
SSDEEP 384:7ZcIhsNC2ftZuQ/HX58EC8xJgXw+2oJtgOIwZOysL4oP:jhMtZvaHwloJXsnUg
TLSH
T158828D32A878AD7B5CF7E145F18A32035FB8A027D7C96F94D6ED5B1D009A2A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5e0b6f07dd89bf84cd635eb21105d142edf6023e11ae6be69b7fd4adaa86bd4
MD5 8c50429de11d98d0c10095955369c653
SHA1 48b5be2a9e8e556224d782661cd77e639049e85a
SHA512 c41d49cab75e723abf84ae72a3aa95a26529333cb0756bda20768afa97e3ded9e28323229b6e8b06eb017ab5dfb77a9c521b0ea3b9fd30f7c6a6e91912615cd4
SSDEEP 192:1ONO6wlDgQmiUyu+W4X58gZejzorxJlDlgFU6:1ONO6kggW4X58EC8xJLkU6
TLSH
T14202E935F9687C6B8EF3AE09B58627139FE5212BE6552F44DAE80A1D00D765C130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4aefa905d8962571b05c0a6b8be06cdee33517bb77913594677005aaeaef2ff1
MD5 697b09fa41d1bec8ba6b901d3e0d0f27
SHA1 3cc124a4e943dd76ec2a40f31d51b7606ae1464a
SHA512 191221fdc0a524fe8d9a9863cf183370689afab1a22943a5845f0b94a711c6138f6c2a9ba3d7739ddc7d8bb6e5809b6ad14305ac3b87ee20bd19a6f51dfe5091
SSDEEP 192:1ONz6wlDcQmiUy8+d4X58gZejzorxJgXA7R+2EveJqwU6:1ONz6ksId4X58EC8xJgXw+2vJU6
TLSH
T147121935F468AC2B5DE2A545B08731039FE66117DB896F90D6EC1B2C01EF69C134ED23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7de6fa9cb222be72fb9f0a5a894279be2fe2bf63895dfb19c50c6abf9b8f8d1f
MD5 662745b260b21afcbe8364674166d48e
SHA1 69aecc8d00d5a81d1b46d29c7303c48dc006bdc4
SHA512 303ed4730caf3f2ed5982dd2d1695ff42584410b3bed8cfeeeb359b33b55c5029a34a306bbcc83652c1597fa0fb0a58cf2ae5c7932f5de59d960db041a82d5fe
SSDEEP 384:CZcIhsNCbftZuQ/HX58EC8xJgXw+2oJtgOIwZOysL4oP:whhtZvaHwloJXsnUg
TLSH
T1C0828C32A878AD7B5CF7E145F18A32035FB8A027D6C96F94D6ED5B1D009A6A8030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9a1cd2c275b91a0f83671dfb65922ae9b2bf8d2d2f2a61c0c48c37f9918dc47a
MD5 91cfa49fd6d645c36a3f64e00a31fa43
SHA1 90c5d9b57fa70d2d31f8bf6cd1fc0814cf4127af
SHA512 b982b7124254676172d099a7d3e6d023732726da248e056552a80e85cf0b09aa80f840d921af80bd6def660d3866797a80d6216fbd37505f797cee9b52c98946
SSDEEP 384:xiFiZcIAzsNa8TUNTUlIlbftZuQ/HX58EC8xJgXw+2/JtgOIwZOysL4oP:YFQcPwgRtZvaHwl/JXsnUg
TLSH
T146A27D3398A8DD7BADFB9645F54A32039FF49067C685AB90E3ED5B1D009B1D8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a659297-4aa7-4c4c-b181-f0d84775c7e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2a659297-4aa7-4c4c-b181-f0d84775c7e7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 42708318e21115b90bed406c3a160abcf650d0da36792bb8c12c8a251d45fa4e
MD5 cf97d5232252aea5f2540d00d507b20c
SHA1 19f5c529dbc22fdd24c5472f9691f6e39332b879
SHA512 29781b6d9d82616a55c19d7c5ec1ea85316f83b693c3a2a55894f56dd103911503858d148c70ea9a6c72b4fbc61cff39abe6fbb34bd5f44d1614dbce67ad6149
TLSH
T1DD411358A6EE1148B3B77F46AFF7A8AD487AB9772F06D55D00020D4E0A27B40D8B1737
MD5 SHA1 SHA512 TLSH

Submit Download