hxxps://www[.]atlassian[.]com/software/trello

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.atlassian.com/software/trello
Sample260805-ebmn8ach89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303751783466071"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{B6F53ED3-AA64-4450-979B-3CFAEAB9468E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 6048	4300	msedge.exe	81
PID 4300 wrote to memory of 360	4300	msedge.exe	82
PID 4300 wrote to memory of 388	4300	msedge.exe	83
PID 4300 wrote to memory of 712	4300	msedge.exe	84
PID 4300 wrote to memory of 388	4300	msedge.exe	83
PID 4300 wrote to memory of 388	4300	msedge.exe	83
PID 4300 wrote to memory of 712	4300	msedge.exe	84
PID 4300 wrote to memory of 1468	4300	msedge.exe	86
PID 4300 wrote to memory of 5224	4300	msedge.exe	87
PID 4300 wrote to memory of 1468	4300	msedge.exe	86
PID 4300 wrote to memory of 1468	4300	msedge.exe	86
PID 4300 wrote to memory of 5224	4300	msedge.exe	87
PID 4300 wrote to memory of 5224	4300	msedge.exe	87
PID 4300 wrote to memory of 5344	4300	msedge.exe	89
PID 4300 wrote to memory of 5344	4300	msedge.exe	89
PID 4300 wrote to memory of 5344	4300	msedge.exe	89
PID 4300 wrote to memory of 4988	4300	msedge.exe	90
PID 4300 wrote to memory of 4988	4300	msedge.exe	90
PID 4300 wrote to memory of 4988	4300	msedge.exe	90
PID 4300 wrote to memory of 6000	4300	msedge.exe	91
PID 4300 wrote to memory of 1044	4300	msedge.exe	92
PID 4300 wrote to memory of 6000	4300	msedge.exe	91
PID 4300 wrote to memory of 1044	4300	msedge.exe	92
PID 4300 wrote to memory of 6020	4300	msedge.exe	93
PID 4300 wrote to memory of 1252	4300	msedge.exe	95
PID 6020 wrote to memory of 780	6020	msedge.exe	96
PID 4300 wrote to memory of 2428	4300	msedge.exe	99
PID 4300 wrote to memory of 5204	4300	msedge.exe	100
PID 4300 wrote to memory of 5384	4300	msedge.exe	101
PID 4300 wrote to memory of 2012	4300	msedge.exe	102
PID 4300 wrote to memory of 2012	4300	msedge.exe	102
PID 4300 wrote to memory of 4688	4300	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.atlassian.com/software/trello
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fff0e8dc188,0x7fff0e8dc194,0x7fff0e8dc1a0
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,769431152278448939,17188457245151210201,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
  2⤵
  - System Time Discovery
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,15902314862167712649,1606500352678265547,262144 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,17545725509028166669,6911634951094146285,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,2516269657364238458,1510268168034106255,2097152 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,7865205639800413735,18123931244721943719,2097152 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,14651624653782612345,11133598408172762844,2097152 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5088,i,2700520920467157546,9080947176943046305,2097152 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,1913984267025756060,7737899548205245397,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,14461269021983505193,15596358307331649114,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,11694708541735867499,6249388053769736382,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5727399107566585951,16286477605533273019,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5727399107566585951,16286477605533273019,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,13219540364803490703,2857227246068227573,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,17433855182696919735,15795836889479795851,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,8106330022009660496,9228660848102883896,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,8592508200917309550,8704918930308918121,524288 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4968,i,1272892170663992962,4051066972393698545,262144 --field-trial-handle=2308,i,11585685195563360335,8671284378633393572,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0b3d6cfb3d481488c544dfec58f39d8865cb3d768621756ff8700fe997c1a9aa
MD5 b5e2ba7c170382292b497cff98dbb26c
SHA1 c185b149ec0eb89b2d9d790db34c738cfea0b9e1
SHA512 a9edd202cb296f09c3a3c4d26695cb7aea398562b662d23b782ecd74b02715e818695c0d31895e3a76788b522f30d978608ef04738873e63adb527b77e52544d
TLSH
T1BCE02BA6CC21A83B48FD272850655786EB45235B1B83495F7A3CD0098FF463E4645C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 de7a014ccd72f2d7f6e6e0359a9f46646b5585179fc681bba601af2af1eb5225
MD5 d55e2753b047305a91aec2b3f0f7a6de
SHA1 c38d98550157a8ec57e21fae15955fefab14826d
SHA512 ccbaadf83e5d488bbe55048a64e5e771b9c25376838f250eb4c3218fcca9f8444071b8854fcba687e2b0a2413dbec21d2be800067352e6b85c6cd8193e1ffc53
SSDEEP 48:oJ7ANlFkT/oPtv8ce7xI91nytcuKJYWV0GFA4IXnZA7gKWhpTJOz4iwRM:g0lFAol8cetI91UKJYWZFAtnZ4ITJV2
TLSH
T1198150034DC685A0EF721276E1E33F7CBA3B7045BE4FAF6206D52838192A7940B5D11C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588b34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588b34.TMP
Size 3KB
SHA256 f24ac119544dbfd207ef13148b08810160ca214848a78f389795140a9007153e
MD5 7f530b5c34d50c44ab25a4f0f2064bcb
SHA1 bdcab24e8e750f16d8e389629b71349276084975
SHA512 d90065bf808e3d7349a97fb20bcc129f2bdf44ae983e52609568ae86b2609b10edf60a17342bb59b8e03a7981686158976ce9021f0196e1b85b5f225641d1a4a
TLSH
T1A0614F160E428891FF7222B2E2D73E7C7C7A7195FD5B2E6116C178395935BA00B2E61C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ceb6bb11c4569b0c58f6a09020def35721039e897408abd54d925051f60ddcdf
MD5 1462193776fd08259212fcda2d68055e
SHA1 6f26fe16be228a874af09560cda877dff09c7ca6
SHA512 765adc210f029487a7b7e38da79264016f97f03f6e910d6b44f1fc92c8869c3a212369da2a187dd1a92e8bc5272d082598262dbd56dce6a6014aa412cec6ad05
SSDEEP 192:D18b6MUHsaaij6YOJbCSQITmKA5g4RuaBeg9BtT:D18b6MUHsaaiGYOJbCSQITmKA5g4RuaV
TLSH
T170D1A0F7D3E59A7D984159F49B28AE2BCE1C0525822C3D6A88D4BE47D3E2971E101A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b443133053bee859ad612e32ae7c7b890656d97c80e975428aa160e6c198fe00
MD5 847bfd0a3e55451e0502246549efe2dd
SHA1 3cf36c89b5001e3b1b12d7f6a08d88b7a4d389a7
SHA512 ead94a4dbc34ab26bf51af91f1232479bc9bf59f28a68d7bf0f02a2001ffe437500dd43a459ab3c269c966c4ed60722ccd99fb5b00bfcac09d030586fd20c4d4
SSDEEP 192:sxZ1RMyMqZjK1Ml8MFt/fssQEKTGNwXzodphY/W6+WNO9s/Y0h/VDwIgj+cnJ:sxZ1pdt/fssQEUwi/bj/5Mj+cJ
TLSH
T1A562F8066A345D7BCCDBD219F645BF53D6F95533A2944E44AAFCDA0C00E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1ea3244e55fa66c3eef9d4e85d97d0d6613942eac6113306ab763a9962b7ae69
MD5 f76763fe3098a53b09c9667bccc84e68
SHA1 306e8703378e9827bc1108f441c229e0ce7fcc9d
SHA512 6f30b3ce90e8df7b1adb77370b147a0a31f86ddd360a36be2f29620eb098e06a5dc30dab8fbcac2911603babfbb2752f2e2f32b715dce92d1239ab6fee085951
SSDEEP 192:sxZ1RMyMqZjK1Ml8UQ6Ft/fssJYKTGNwXzodphY/W6+WNO9s/Y0hzVDwIg59+cnJ:sxZ1pqgt/fssJYUwi/bj/5QH+cJ
TLSH
T16962F8066A345D7BCCDBD219F645BF53D2F95573A2944E44AAFCDA1C00E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 727203109aae75587e37576339680dca7bcc3845812ccdc6fd952aa5b9328a86
MD5 12efbda6a2f359921de10e17e67982b9
SHA1 dee40df25e27d6bebbd75e784e7d4c394e4b72ba
SHA512 a167eaab34954364c0635cf40661496af84a39a9b04b3befe79bb605befa23d9ca6a010ef5e06c7bbee7caea437b358be90a3659f5273588fe45e31665abb99a
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5Y:GZLVDJjEDPV0/Zdakm
TLSH
T10EA2690232BA42023C7D790C92969B674A42F163345DAD3F7BB900B54E67E225DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fbb0381d166ddde56f552650609d49e40ad98f61b6fb1b445eafaed604e1c8b8
MD5 364fbc8caa027b50046ed7666f88f377
SHA1 b674f965c271ee7370d88d208f2037c2abd33136
SHA512 0846a14cf5ca7e90e74c61d31528edec43fb8bd7e121cf1c6f10f2584bf3ceed5b3256856e0b7cad87bb9cbecb5ffc5a9a036a3529d2c5d8b63ed6be10ae5819
SSDEEP 384:nFiF9CcmyWCs38NF8TUNTUlIxBPm3ek32nn9pCi4Jfb8GPxwAHAVsZue4KV8p0zo:MFccps3ywgPKekmu6GPxwiuI8p0s
TLSH
T156C24932E854C9ABECDA0F99F64A7543DEE05263868C9EE8DACC5D1D009B1AD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3fe16bccf89475f66481d5075ff370d71d89fc58a101c74dd80191f8f4f8910d
MD5 29a21c76f90028354b3c23155eb922c3
SHA1 3c9c2ae1126248ed46fc06e4ecfdbeda772fbd64
SHA512 b46e2ab14d37c2eeeffc67fc6020d0613fe157b423a02b77fbbb33777b66b34943d89b0ae1adc10fcf43c683985e335b42d986429c5932cd5925dee852a72a62
SSDEEP 768:DFQ03iwgKKekmzLGPxwKuTjKgqmUNhOGe:+035k7a7igRUN8Ge
TLSH
T177D24931D864DAABECEB4E89F75A7A03DEF04163969C9ED8E6DD5C1C009749D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 af366c302fd0ab2892dba5339ed06676069ca1de417f88008345944c2655eaae
MD5 d4c4c03ab28bf749ad195926bdd04020
SHA1 870593dff86db0951da36a10b1f0ddb618dbabfd
SHA512 bbfa93066257250e6991ecd138afeafd5162a20880540575b86b3c3e7c5accaf083a2189cd1c5577bb87dc07104979b368f17ecb073bdce5e93e28c439999299
SSDEEP 768:wFQ03iwgKKekm4LGPxwKuTjKgqmUNhOGe:p035kqa7igRUN8Ge
TLSH
T151D24931D864DAABECEB4E89F75A7A03DEF04163969C9ED8E6DD5C1C009749D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f35128513665b8a2fadc89a8497274d8b8e4dca62c5a4a0f528981f9f2cbb2f1
MD5 fa2d7935a53bc36fea11e36d293e20da
SHA1 596d1a5b2c665010dd80d72371a5c4785bfcfe08
SHA512 9803d254cbf950daa142747d8d09233d24ac806502496ca313689aeb3e36175a6772d722b9ebd4b837037c0654d9b54632624a802eac3d038f1f57f92da2b0dd
SSDEEP 768:4FQl3iwgKKekmWLGPxwLuTjKgqmUNhOGe:hl35k4ayigRUN8Ge
TLSH
T167F2C2F198D79977E8AE4B87A77D2E029AFCC113B5885994B7C85C1CCC464BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 78ed2d55ce159492083d5cb14dcff92ee14f385256bebcd018c1f1f4d1ffbe02
MD5 bc6c23909186f2e49263d106890ccf86
SHA1 a53b2ac396205c181b5a486935d533ccd9916c61
SHA512 96f747fd8f07ffa87d958d06042509e4f8e604ddf1414f98ce1f493b184f063a37206809e71b1bd0964b627be469f2de2328e4369bf5a600c2337a055cf10fd9
SSDEEP 384:nAiF9CcmyWCs38NP8TUNTUlIxBPm3ek32nn9ByQFs4Jfb8GPxwAHA1re4KV8p0zo:bFccps3EwgPKekmqqwGPxwprI8p0s
TLSH
T16EB25A31EC68CAABECEB0F99F74E7A46DEE05223859C49D8DAD85D0D009719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-354-0x0000024108450000-0x0000024109450000-memory.dmp

Download