2589c83f942407150ea3d21ba8c1aa1f946c806a367973ae908c251864326220

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Meritrust CU/login2.html
Size 11KB
Sample261001-ppvxvsxwft
SHA256 2589c83f942407150ea3d21ba8c1aa1f946c806a367973ae908c251864326220
MD5 4003ee7bf1fd8e825f7a9a4ade3701a0
SHA1 6e14b79ae5d4a189d001698e46bba1a30e7b51dc
SHA512 fca4ed71a30d8d4f27d91e0e79717d3aabb8cb5442268820dee9e0cc03a885250842956ae2a9a179daae98c6fc6cd6469b985fd832e2fb496fa008bb7195d074
SSDEEP 192:mfXEA+MU89vRyjTnDK4Mxl1xdREG92DwUfLcyek/+:mR+GlEGtUjcyB/+
TLSH
T1E84261A6924714026933D3A4AF63030DFB568023C30682583FEC63966F75B479963FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5008	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{69208555-9EE0-4455-9914-E3E28A965A15}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 3312	5232	msedge.exe	88
PID 5232 wrote to memory of 6092	5232	msedge.exe	90
PID 5232 wrote to memory of 5008	5232	msedge.exe	91
PID 5232 wrote to memory of 6092	5232	msedge.exe	90
PID 5232 wrote to memory of 6092	5232	msedge.exe	90
PID 5232 wrote to memory of 3948	5232	msedge.exe	92
PID 5232 wrote to memory of 3948	5232	msedge.exe	92
PID 5232 wrote to memory of 5216	5232	msedge.exe	93
PID 5232 wrote to memory of 5216	5232	msedge.exe	93
PID 5232 wrote to memory of 5216	5232	msedge.exe	93
PID 5232 wrote to memory of 2940	5232	msedge.exe	94
PID 5232 wrote to memory of 2940	5232	msedge.exe	94
PID 5232 wrote to memory of 2940	5232	msedge.exe	94
PID 5232 wrote to memory of 2816	5232	msedge.exe	95
PID 5232 wrote to memory of 2244	5232	msedge.exe	96
PID 5232 wrote to memory of 2816	5232	msedge.exe	95
PID 5232 wrote to memory of 2816	5232	msedge.exe	95
PID 5232 wrote to memory of 2244	5232	msedge.exe	96
PID 5232 wrote to memory of 2244	5232	msedge.exe	96
PID 5232 wrote to memory of 1320	5232	msedge.exe	99
PID 5232 wrote to memory of 1320	5232	msedge.exe	99
PID 5232 wrote to memory of 3696	5232	msedge.exe	100
PID 5232 wrote to memory of 3696	5232	msedge.exe	100
PID 5232 wrote to memory of 6128	5232	msedge.exe	103
PID 5232 wrote to memory of 3284	5232	msedge.exe	106
PID 5232 wrote to memory of 1264	5232	msedge.exe	107
PID 5232 wrote to memory of 4516	5232	msedge.exe	108
PID 5232 wrote to memory of 2600	5232	msedge.exe	109
PID 5232 wrote to memory of 2600	5232	msedge.exe	109
PID 5232 wrote to memory of 2032	5232	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Meritrust CU\login2.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffa6bdcc188,0x7ffa6bdcc194,0x7ffa6bdcc1a0
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,6383562558151928241,11047433733607492591,262144 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,12424896304812933436,12215193192127054315,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,4590853363135202319,14650419322002554037,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,10797242230055109448,2397916169783915689,2097152 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,6259991277048311060,10940437028215715558,2097152 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,3986343349672019294,5582260312914981423,2097152 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,3449663332668486043,415004942250036627,2097152 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,12684129272556261279,2863598126540088211,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,11023032602639961271,4105099194978579702,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2755268723694395726,11558532930725790108,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2755268723694395726,11558532930725790108,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,15531839755865844107,6665125019245131714,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,12612109046207643519,1584347445963770191,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,7290458313670443610,2315511700273094931,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,5754800128513202003,15573373448538695032,524288 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,9219216371291488168,1301500782733920338,262144 --field-trial-handle=2608,i,4230528411336064433,14595432469553438202,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1dae9b8cb59eea8c9eb63aa702afce45914f63bbe195c845ca002daac8783bab
MD5 18a0baa753e4fa480b644af8cbab1277
SHA1 1679c403138707263747da6f9154eb7586da2392
SHA512 0c5836ee56f744a2ce4031ad16c4faae89de54f22d77da74974eae5b83c812381a3ca68c723a3da491592e735bcb694f61835d00288bc4f18be786f6748157ca
TLSH
T1BF510044A8BF62B6EBC5013149E0B28B353466729E837F128B64DCF97B267D483850CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b7ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b7ae.TMP
Size 2KB
SHA256 be2e5a590d49d6f7703c7f10170b45f15677510dcaa21956953bc69bd33563bf
MD5 3b93cb21c29ac4677f6dc7a13753a402
SHA1 dbcc9c88b6780e802a8f976ba75d52f6cd08cec3
SHA512 c8cd74dc36a0aee54b488f671a0999852874d1bb313f0b2b4b805e2a94f231bf66373fa28dd920926986a2e84a188f07e2279e051e7058d6ee9d5259085b475b
TLSH
T14151FF44A8BF62B6EBC5013149E0B28B3534A6728E837F128B64DCF97B267D4838508C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f244d0487ec189c4bf0eea8f88666ec45062bdf142f7c44e7d47d40c3452fd31
MD5 1774e358dbb34eef5d593d1b2c1247e4
SHA1 bc1c3e364a409fe9d4f3b0a77c56d5bdee01a776
SHA512 56c1ddd28f2e5834f8258816f4ff366f8ae6705366802cdffc1333220e0ccc2697c4e76ee16e8e75c79380d8ef07777da425977fac1af152c1e61ee871d2a768
TLSH
T13951A0F7C7E8867D890156F4AB196E1BCE1D0515432C3C5AC8E4AF1B93E38B1E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e1b8d4cf88d3a3d088a8a9fdd6f2b2ff36e546ee484d62e75aed76abccb22547
MD5 5805c55cb29575ec0f8babfef7b003d0
SHA1 588465bdb656cbf041ee7cb67d4185ddddcdb201
SHA512 30c70ffe39e2f0c721d5da34f3f3f3f573256192df302e0e5933afe826e646107b084047f2fb6e674018ba4e95e026272a77734dad08c3cc8e9dc9abfdb4da40
SSDEEP 192:sxRFR1bW/fLsmK7x/qzoA8p4K/g6+WNIYDLuG/IgDmJ:sxRFXW/fLsm61D/5I4W
TLSH
T1A532C815AE28A97B8CCBE21DBB55BF53D3F9603260951E48B6FC8A1C04E76DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 39da43142229c7eac5621056f87d11b344091967e6e6a5a22fe0e9a33a40fcd0
MD5 3e4755593a74489a812f1d28f73f55a1
SHA1 220d1e3d6890990947dadeec2cd1c8ee06efa8fd
SHA512 74ef7cce8bf2f272c9a5a03c002d4ae4d695844be675043e113a05ce866d5e578340833cd504c861424c6a2e2c22f9e3454b4129677b474693fa4b945fd31b2a
SSDEEP 192:sxRaR1bW/fLsMK7x/qzoA8p4K/g6+WNIYDFuG/IgIJ:sxRaXW/fLsM61D/5IMs
TLSH
T18D32A7159E28A97B8CC7E21DBB55BF53D2F9603261941E58F6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5da45b15608b3547425bf0de32843de455f3153de5347720398e84b81da9072b
MD5 7df0e3f8fae8628b3f8e9de7f6bbab78
SHA1 d0d8a4d606228d48a3e946bb49b6ae3138689fba
SHA512 680c24ac41092d0f006f9c2df632f3e07ccda87065deddb0411fdf6c8a2745b1d85602de695c0572cf0aed360f0d21af63396993b1eab9d6433852ba682f8bf1
SSDEEP 192:sxRFR1bW/fLsbK7x/qzoA8p4K/g6+WNIYDFuG/IgD0J:sxRFXW/fLsb61D/5IMs
TLSH
T18F32B815AD68A97B8CC7D21DFB55BF53D3F9603261901E58B6FC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 aaba4fca601c6b0505e11ca47ee000452f5e7befd2c74a06eb025543fe878a6b
MD5 f722e10cbb578ad5f233baee26946a8d
SHA1 992358e91e333fba62b317d20b1275e6030e413c
SHA512 50ae8f116b898114555943400341b2743d4663c60075c79ad1531470c44a2c43c15a39ce5428f4f545eded468e8edb6c7234a125b5bfc9639046d95d6716eee2
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9UroTy/:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0Vb
TLSH
T114B2DA2B640CC77E4F814AADEC196F967D5802C796988D4047FE994C03C77EB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6732ba9b4db2937576d76cc06b82414375056fb76a296b846a09a1d86c58ad0c
MD5 feb61943c1a902e8a2906b09d89d3457
SHA1 5083e9c4d8071ad33cb1ab5cb2a1204406f3fadb
SHA512 0e6ca73275aed68b29936301afba7491b5fad23fc5dd6de40bacd8e81db61f923a7c8930a6c0a38a8c8c6ec3f0d49c8f4198d4f1b02fab73ba6204f95eafb8a3
SSDEEP 48:K4BI9KKY4PyjGbIZK0QknyREI/Kd+c20T6eMiidVS:K4BSKKYihbGK0Q+yEAKd+zY
TLSH
T17191118131AF021039BE294989A4CB1E52813173341DE6BB7FBC5059CE6BE056EFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

af731664-8fbd-45ac-b0b9-017339468120.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\af731664-8fbd-45ac-b0b9-017339468120.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7b5613697084a5790569e9a27b661d9886252bd4356916bf300a74f127648ff9
MD5 8c5a74e850f20d3f595ae40866677235
SHA1 74093202be463d1c2b2c5554bf600670752b198e
SHA512 af747da20908f1a59421a7d702ec2d6b03686e83ab2786a2ee9403db7a98de05ef5f8dab29f8f97de1a2c1acdb48298c40a79b112fca0aee42725589d1e1a47a
SSDEEP 768:d/UxvxjgC+Z3OpsrJybNbeIZ4OeRFZD1fTos7RjGm0y:AZj3+Z3Gs9/EDY1fT/RKm0y
TLSH
T1B303BF3AB8985C374DF6E240B24E7747BFF455A395C9699809EC1E0E05CBBBD130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b347c64ce2a3a32eaca069fdc7cd02fa60125ba714f7b64e6c23941ffd9df8e7
MD5 7fd70540924d8e4051cbe681e6cfc53f
SHA1 7696a1055cf74db4a2f594f64d4e5b1dd614876b
SHA512 cba4c59bebe558cc0d48d37df9d16de9d2e2bab0ef6e5ee014137ba0fc61617858f40cc5daf4a148e9ed3d80bd35857c8ee81ca3cc5d28b126fcd70b57d420da
SSDEEP 768:xk3VpRJybNbeIZNOeRFZD1fTos7RjG2s36:xk3H3/EgY1fT/RK2s36
TLSH
T115F2AE35B8E48D775CF6D280B24A76027FF45563D9CD5A8444DC6E1E049BABE130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6474fd601fb1f510e6e0d89fda6ea0f846e951052e7ec4387802c97e8ef4c336
MD5 13755cea82470254dea09b50e64c4f15
SHA1 b6390ff6595fc4040c4f8f6dda1f7496804d0338
SHA512 1393f25c68c44489985a5c540eb15db1d19d1ec03aca1a3c683dc110a9719875605628f62a6e0d75a08fc13261d8332cae8ab8bf50ef7a121a231dc0fb1cf442
SSDEEP 768:9k3ApRJybNbeIZNOeRFZD1fTos7RjG2s36:9k3A3/EgY1fT/RK2s36
TLSH
T152F2BE35B8E48D775CF6D280B24A76027FF49563DACD5A8444DC6F1E049BABE130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 1f4a0f949443ab00a3ec9c5b3f10fe21c8c65330d5577d105ca938a6c02040d4
MD5 b570d0f80bed55e3269ad76c1fc6d6c6
SHA1 9a24778a1f9ce31b057ae2a4af3c8a9ce59f0a4f
SHA512 a3e90b5047bff22672c59c6abd4f5136305e778f48e443901b061d2395e7bf3b54f78f4aeb3ffca6e5789372ae7a4afbf29d056082f5bf95520ed0c3d788f247
SSDEEP 768:VFQE3Kwg1pRJybNbeIZxOeRFZD1fTos7RjG2s36:0E3S3/EEY1fT/RK2s36
TLSH
T1ACF2BF36A8D4CD7B5DF6D780F24A7602AFF451A3C9C9968495DC5E0E009BAED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8936bd43b59af3fbbadae59f7082af754f422d58007bf4da551b87665c5ed6c5
MD5 a589eb8ad6d4103ed28dd9f9adb90830
SHA1 36a2c922e6c191a7dceffd30dcbea744c7805147
SHA512 8e36b2326f9e841aaaaddf32d4aa451f08f732ab64ddc5c8182a16268c1d4e07f42a4427b802f1611adfdd59c1691fc65c2575a3bbd51b2ecac95abb25f7f5ea
SSDEEP 768:z/UxvxjgC+k3UpdybNbeIJOeRFZD1fTos7Rzf1/+Pu:GZj3+k3U3/JY1fT/RL1Ku
TLSH
T18803BE3AF8D85C378CF2E244724A764BBFF055B395C91A9809ED2F0E058B7AD1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1658711-5b6a-4faa-b082-526ae0e969fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d1658711-5b6a-4faa-b082-526ae0e969fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download