dd8280ce02828e4074cff79ff6712f7da79054662e1325b18eaa177c542d866c

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecureMessageAtt.html
Size 20KB
Sample260929-wmelestthy
SHA256 dd8280ce02828e4074cff79ff6712f7da79054662e1325b18eaa177c542d866c
MD5 6932c8e47a8b6676d24f074ae3921178
SHA1 c6b2b8aa88f0d1931b6d0e1cfc0852917c6d446d
SHA512 e38ec185b65010b0f407ab285df8cbed41a55a4bc7dbb6a3d69116e10fa720abb62a71b73a5f769185182512486df77e2a43e16f0efd4cf0b3d46154463a93c5
SSDEEP 384:CFaJbYXdFXJ3tKJSEknpGvqoyW9D29wlfosdluHeD+c:C4CXJNEoOqPip+Ql+c
TLSH
T16792BF12E349AE6B0832043A9861FB5D983C01D752D253863A9FBB4FA768C7006F77DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{04486F93-5FF0-4045-8319-C7DC942E8202}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 1880	3788	msedge.exe	85
PID 3788 wrote to memory of 2992	3788	msedge.exe	86
PID 3788 wrote to memory of 5076	3788	msedge.exe	87
PID 3788 wrote to memory of 5076	3788	msedge.exe	87
PID 3788 wrote to memory of 5076	3788	msedge.exe	87
PID 3788 wrote to memory of 3844	3788	msedge.exe	89
PID 3788 wrote to memory of 3844	3788	msedge.exe	89
PID 3788 wrote to memory of 952	3788	msedge.exe	90
PID 3788 wrote to memory of 952	3788	msedge.exe	90
PID 3788 wrote to memory of 952	3788	msedge.exe	90
PID 3788 wrote to memory of 1424	3788	msedge.exe	91
PID 3788 wrote to memory of 1424	3788	msedge.exe	91
PID 3788 wrote to memory of 1424	3788	msedge.exe	91
PID 3788 wrote to memory of 904	3788	msedge.exe	93
PID 3788 wrote to memory of 904	3788	msedge.exe	93
PID 3788 wrote to memory of 904	3788	msedge.exe	93
PID 3788 wrote to memory of 3680	3788	msedge.exe	92
PID 3788 wrote to memory of 3680	3788	msedge.exe	92
PID 3788 wrote to memory of 3680	3788	msedge.exe	92
PID 3788 wrote to memory of 4188	3788	msedge.exe	97
PID 3788 wrote to memory of 4188	3788	msedge.exe	97
PID 3788 wrote to memory of 4548	3788	msedge.exe	98
PID 3788 wrote to memory of 4548	3788	msedge.exe	98
PID 3788 wrote to memory of 3272	3788	msedge.exe	101
PID 3788 wrote to memory of 3804	3788	msedge.exe	108
PID 3788 wrote to memory of 3804	3788	msedge.exe	108
PID 3788 wrote to memory of 3804	3788	msedge.exe	108
PID 3788 wrote to memory of 3396	3788	msedge.exe	113
PID 3788 wrote to memory of 4020	3788	msedge.exe	114
PID 3788 wrote to memory of 2728	3788	msedge.exe	115
PID 3788 wrote to memory of 2152	3788	msedge.exe	124
PID 3788 wrote to memory of 2152	3788	msedge.exe	124
PID 3788 wrote to memory of 2672	3788	msedge.exe	125
PID 3788 wrote to memory of 2672	3788	msedge.exe	125
PID 3788 wrote to memory of 1984	3788	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SecureMessageAtt.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa5bb7c188,0x7ffa5bb7c194,0x7ffa5bb7c1a0
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,11039184314441061904,10298327421497016075,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,18199044095604711518,18359713734134783718,262144 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,9561970998996021277,15976071663243336638,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,17048388811726085082,6592124624177788265,2097152 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,3580022423492185113,10687964377674005299,2097152 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7635409072059134161,14358888843133249365,2097152 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,2439466023761635716,17711855986215426240,2097152 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16547426645747641332,407783910420765605,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2605217316552170042,15987878508648247508,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5412603535777931712,7211082723904689413,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5412603535777931712,7211082723904689413,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6256,i,14935495541035708692,11097282390473564289,2097152 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,2168461098109685421,12196853157088365270,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,11410407971690958723,12762617726514007918,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,15867518032650395860,7991695458150952375,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,17701441800003799492,18263012187004140460,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17593971556391005285,3546939921866576850,524288 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,721925797245844728,4307975203630288920,262144 --field-trial-handle=2196,i,14435481484011483020,812179109482093396,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9ca72b8fa0dee39f44d629d81d1a7c028066b7ce7bfa7652a8da0ea0255e156d
MD5 1397b54ccf4ab3c2cf137de9c7dc6087
SHA1 90b126b595addd7405d0aed983db973847391865
SHA512 d48055f9de33165b846e740a68ff99493f27de339f0382105099b8df927434768286d324067e54a32747ff4e92e3e078b63cb48299c622efb03aaff2567f7a75
TLSH
T14151838177E4D084FF985FB1D0C918AFBA31D18CA883BF131F94E4796B1637881093A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 115a25c679eb1813cbdd564ed4204c0fbef6d2a215ff95f300656fa1ffd94fd0
MD5 1ff07bc844e88bc17557489e64dead54
SHA1 a0dff8f236ea60ab4aef99e2b8fa3a404a6289ff
SHA512 bc846462220659cdfcbb02d580ff2f8bc58e7616e4e56e06023e877723f4a3c81faca6637bd99c84b79b02b888b2a4d4f85a697df7c892dff459376fd7a2ff3e
TLSH
T15A2179F383E585AECE0156F05A24AE2BCE2D0512432C7C2989D4EF2793F3475E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5f9ab9016781a11c915f1edd5efbbe9ae95efa737dfd019aaf3bd54cf95c804b
MD5 eb354275029af87a6fe468b39a6bbd98
SHA1 05fc5267e441e0f3f762625d348bbd72253c8949
SHA512 0a6a9a9408121d4f542d996adcbb9474dd6c02f4cc712a3aaa377f43f9d7e96d9579867722422a60672c64c8fc86aba2de23517c8907949f637315333da0d6d3
SSDEEP 192:sxZoI6RgWfe/f/Dso69IdpdoPHW6+WNGYgU/+4vIgrJ:sxZoI6Nfe/f/Dso6+mPHbGIJ9
TLSH
T1D822B6516E38A97B8CC7D20DBA25BF53E6F9503265D41E88EAFC861C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 35589761cee20045fb5c1784d1b19162434fe919c50472214828733a0f81560b
MD5 36c3f4d5a41c73a5f5f50ea28c5c9748
SHA1 459d97c8b43783a2de0c54f021b74dec3c20e760
SHA512 4bf082d1d074555c398404c1929a1c665076153a18073f2a3a4f57ebb1207a4ad803ec6d664726c058e8e10323fb4c1a218502e336206c08d545ee4edae0929f
SSDEEP 192:sxZoI6RgWfe/f/DsvB9IdpdoQ2HW6+WNGYg3/+4vIg5PJ:sxZoI6Nfe/f/DsvB+mLHbG1Jr
TLSH
T12E22B651AE38A97B8CC7D20DBA25BF53E6F9503255D51E88A6FC861C05E7BCD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3e1b0fd876d6cfb2784fc533617f55bedecb359398e0ceeb335a70602f19452e
MD5 dc6770555f105a33cd4a16cf1eb4aa5a
SHA1 99b700c398b248600b84381303c1c783375218ef
SHA512 d00099f51eb34a8562a9546fdf5cbba407d2d06f785bb4d3033fb53b845a81ba5320f083d65064708eae0b0ffdbb7d6574156ba3a75a8461df96d933f90f3905
SSDEEP 192:sxZoI6RgWfe/f/DsvB9IdpHoQ2HW6+WNGYgz/+4vIg5PJ:sxZoI6Nfe/f/DsvB+ILHbGdJr
TLSH
T14822B751AE38A97B8CC7D20DBA25BF53E6F9503255D11E88A6FC861C05E7BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cd9f905f43b94824ac1af94e4c679dacf5ffe04d5e1b4ed4458c892fde6da890
MD5 7c8978c81856025818b17093d160f968
SHA1 4c6570f873746c89d19cabc1bb56884fb12e8451
SHA512 653f61b03ba1caff8f3878938b563e02a97d5131323443227175676198878b812e909e806d0dafee8e4babce637481648a170bed44e3798ae30a949094c19cb3
SSDEEP 192:sxZoI6RgWfe/f/Ds0B9IdpdoQ2HW6+WNGYgU/+4vIg5lJ:sxZoI6Nfe/f/Ds0B+mLHbGIJF
TLSH
T16622A551AE38A97B8CC7D20DBA25BF53E5F9103295D11E88AAFC961C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5b7ecea42e0514960b0e388707269bf385a16607ad568bb447096251f6cd109c
MD5 0b2500c7327b5586fa9a930e61b5da12
SHA1 a1fc230ea3e5ecb3d6bedba8bca8524e370a20f2
SHA512 64d58d6e7c058b4b00e6d3c931d568e712290d4220bb7210bf1752f2bd088e3e51eb6eacda798a8f60d1fd17e55c7e920c8390dca45d2f9e48dcefe46b08ce9a
SSDEEP 768:MdichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzfroL2T:MdichfPWvPZplu1jan+LKgzMiT
TLSH
T189C2E93B644CCA7E4FC01A5DDD166F977EA802C7AA588D4047FA984C02C77EE61264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a9db3cb7125eb2a8863d503d1c542946082b460eb483f5451574de3715732a00
MD5 756693221ad769d90af98526c07f1c98
SHA1 73903580e9658de2c17f5f19ecffa4a5c5e689cb
SHA512 0daac9f44e9b72306ab901c35d4196953d74c0bec32b73b3ec061d3e756df1457ef6118dcbeab925a28710e3711d53da75e0b10bdf7a86194d44f7d01db30166
SSDEEP 48:K00DCOcey7bCxKISm7K9C1Q7x0rYZ6SIyLZo1JTXrEbXyvIShEK9h1LExpUYSTLc:KoLWKQsSKeoKDicV6Km4C9
TLSH
T1D0911E5132BB16043D7E65499275962F424171B37098EA7AFFFC20B24F6AE090CFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59819a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59819a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2ec8701f32a31cca912919c0ed07b9647b5144f3120907bde0d877de6cf8cfea
MD5 b3772ff0a6a2fbad99558c43679de57e
SHA1 8ac96b14be351ca60ca5e3a7b015bd96901bf919
SHA512 61c46b1099d6870c879655c043a523da0a424124203ebeb91b80513458fb4ebe7f97e901df6f72362758fa39c6db4d3bcb1f459737199cfcc0c4097cd48ddd3a
SSDEEP 384:QZcIhsNXU1pg5WHBm8BGYX5EWS4It18UVktgOIwZOydkoU:uhARGGYuWXIt6UVkXsPD
TLSH
T16F828D72D8789C7B5CE79145F58B36034FB88127EBC87B9495FD5B1C00EA5D9130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bee706b7b7760f86f3368dbc6963c93e8cceb4939a17c4b3968983783cc2b5dc
MD5 211ae81d7a6c907df0fadaf83b912e2c
SHA1 a47587feac91df530412ee8b20af64e2e8d8db71
SHA512 5815148efbddc1e83dce5c916f3b51b0b0e00fa3c4b5d47caa2e5ceaeaf81e297cac280d38ab4703f6796d764cf33473286ada5834d2fcff85c01a9d4318aa0d
SSDEEP 384:giFiZcIKzsNM8TUNTUlIlepg5WHbm8BGYX5EWS4It18UBktgOIwZOydkoU:7FQCxwgN3GGYuWXIt6UBkXsPD
TLSH
T177C22BF288E7887ADDAE5747B77E2E034E7CC027B584A654B398551CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c9f739ce286fa35bc5c23ccd950d4a633504bf86d463a5dcc8f3e95d94f2bc63
MD5 6844ed9a4ff8389ef20ee1e856a1b8a4
SHA1 7cae7b561cac5c9d6a2c927f5b0c1609f25f99b9
SHA512 1aac511f55e917f285a73c5530083f098f274b6e911c0fdcb867621031c63960a169b305ce9a781956d563ac352f0ead0527396094701dbeed7dd35b5265b633
SSDEEP 384:fZcIhsNXUepg5WHBm8BGYX5EWS4It18UVktgOIwZOydkoU:3h/RGGYuWXIt6UVkXsPD
TLSH
T11A827D72D8789C7B5CE7A145F58B36034FB8812BEBC8BB9495FD5B1C00EA599130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a5674f77343ea1db4ecfb6259d02eb64061f6ad1a7c123d6f4187e581b16fcf
MD5 a82770e6a3b92c209a5c4b5a2acf9f7b
SHA1 00f6b255d2768d9142d119a2375f3f54b0c57850
SHA512 556606150dd2c55a2687db214f1a3444d86b8e99a34a2b435752ca7295f67920018f75a3f10869eaffa87fc0d9ba13de19b487db1381af79ce153f07cfb78c52
SSDEEP 192:LJONg6DphmqQmiUyoNq8wGYX59eznCS3oInkk7oLqbU6:lONg619pRwGYX5EWS4IPqqbU6
TLSH
T10702EA39E87D7C7B4EE36E45F5872B139F98112BAA942F84D6E81A1C01D769C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca45bf3b889be2e674736b0fed554732d69b69e05c21d520dc34a841dc5fbc45
MD5 2854fb9d567ac8f24efa7e5d9255df24
SHA1 1de6d273f0c1aa5dd7e2c833957a19be0aea40cd
SHA512 cce4825fd4b083745289f60edddee938b17c06427c053d07f849175ed53a4b0e2294d0ea6b8f7a2c51e44b44e9a7648650d87319ac2ef7f2e0d25331351d796d
SSDEEP 192:LJON16DphEqQmiUyLNswGYX59eznCS3oIt18UFkIIRq5DU6:lON161bUswGYX5EWS4It18UukU6
TLSH
T174121A35E8B8AC3B5DD36595F48736138FA4422BEB887F94D5EC1A1C01DF69C130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4bdfd595de84c66535fde932261be4b8613cebaa99d7090cb447ca00cc4cedb2
MD5 93664af89c40e7277294fb4234c802cc
SHA1 10b84c90cecf95e15576be79dcc4dc0a9e9f7b93
SHA512 2f2e7cf0bb5b77d2634b02f81bab5314eb589c477827b3be4c36db49b7c9dc477824ce82929e40014ff66acdae6a9dddbbc72d676706ffc6968d1e90626eef40
TLSH
T19B41F658A6F90148B377AE56ABF7B87D483FB9372F0691AD10110E4F0A67A01C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3272-196-0x000001B59F8E0000-0x000001B59F941000-memory.dmp

Download