hxxp://shiplift[.]com

Resubmissions

29/06/2026, 23:00

260629-2zfbdahs9w4

29/06/2026, 22:54

260629-2vj4rsg19y4

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://shiplift.com
Sample260629-2zfbdahs9w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272478551835989"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{79DD0D9A-6377-4010-B47C-939987C8730F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 2112	5548	msedge.exe	80
PID 5548 wrote to memory of 5760	5548	msedge.exe	81
PID 5548 wrote to memory of 792	5548	msedge.exe	82
PID 5548 wrote to memory of 5760	5548	msedge.exe	81
PID 5548 wrote to memory of 5760	5548	msedge.exe	81
PID 5548 wrote to memory of 4280	5548	msedge.exe	84
PID 5548 wrote to memory of 4280	5548	msedge.exe	84
PID 5548 wrote to memory of 4008	5548	msedge.exe	85
PID 5548 wrote to memory of 4008	5548	msedge.exe	85
PID 5548 wrote to memory of 4008	5548	msedge.exe	85
PID 5548 wrote to memory of 3304	5548	msedge.exe	86
PID 5548 wrote to memory of 3304	5548	msedge.exe	86
PID 5548 wrote to memory of 3304	5548	msedge.exe	86
PID 5548 wrote to memory of 4212	5548	msedge.exe	88
PID 5548 wrote to memory of 4212	5548	msedge.exe	88
PID 5548 wrote to memory of 4212	5548	msedge.exe	88
PID 5548 wrote to memory of 5300	5548	msedge.exe	89
PID 5548 wrote to memory of 5300	5548	msedge.exe	89
PID 5548 wrote to memory of 5300	5548	msedge.exe	89
PID 5548 wrote to memory of 5384	5548	msedge.exe	90
PID 5548 wrote to memory of 3412	5548	msedge.exe	91
PID 5548 wrote to memory of 5384	5548	msedge.exe	90
PID 5548 wrote to memory of 3412	5548	msedge.exe	91
PID 5548 wrote to memory of 4004	5548	msedge.exe	93
PID 5548 wrote to memory of 5604	5548	msedge.exe	94
PID 5604 wrote to memory of 2772	5604	msedge.exe	95
PID 5548 wrote to memory of 4596	5548	msedge.exe	98
PID 5548 wrote to memory of 428	5548	msedge.exe	99
PID 5548 wrote to memory of 4108	5548	msedge.exe	100
PID 5548 wrote to memory of 2932	5548	msedge.exe	101
PID 5548 wrote to memory of 2932	5548	msedge.exe	101
PID 5548 wrote to memory of 5788	5548	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://shiplift.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc5808c188,0x7ffc5808c194,0x7ffc5808c1a0
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,3274673643686950616,18301074813897787354,262144 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,19817388622556424,15394204083707940279,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,5478306387875820436,14022066799110776374,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,15116091004254571484,17862318796535869954,2097152 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,9078796113116778641,9639796127412610530,2097152 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,17896017918226364196,13959755063317751577,2097152 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4796,i,6795761341937205581,12410312629486945375,2097152 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,1926245958926639200,6441310850733810932,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,2263643096970172527,6589530503052529055,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18445111753614401003,14691296129130131235,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,18445111753614401003,14691296129130131235,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,12197223042231289999,10553345279164544590,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,11190863331498021120,15130128834536598539,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,13825943244729656520,11800252442665075275,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,8913595784662002581,10233794964678418153,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6977679761031772077,7442846963619528659,524288 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2404,i,18049705298596900863,4916568220111261926,262144 --field-trial-handle=2144,i,16941160601451740281,1868966933576526220,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 db83975aa35ad96415c00220f0f964b0148bb31a03f00cabd454d8cdbe29f0a3
MD5 4bc196749879dfe97bd4cde068dd0af8
SHA1 f810c62d718c3f9706845962613c0113cc17f7dd
SHA512 25962bd1f18386b1ef9444bce43e1018ccac369d860f4998a081ebd3add7387367cce832a31f3a3bc4cbeb083ee364c4e49dcbee050028de27ac32863eb6cf50
TLSH
T1FCE02BF6C9229C2B09FD0B1C74501A82EB0123263B81595F3A3D820D8FB463A059A95C
MD5 SHA1 SHA512 TLSH

Submit Download

02268cdb38a1193b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02268cdb38a1193b_0
Size 238B
SHA256 448c9e8b96518b5663a5c777c90b662abae3dd17032b4a6e40694fe597a7a780
MD5 30ce5b93562d0c8999201f054d29d008
SHA1 1f54811a9bfa8ee758984b18fe666b64a6a465cd
SHA512 9b73d9c2db1bdfa60f060917e665fa2aa474ca8bb31461252195f3153bfe1863c130180689ec9f7a5511295ae807fe459e4f52f8249999bee40cc9f777825651
TLSH
T17CD0A7938560AC55CA5986F1DEEFD6748012927AC4D9C1E58014D9A3529A5B25144604
MD5 SHA1 SHA512 TLSH

Submit Download

03b592d6e7ddbe8f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03b592d6e7ddbe8f_0
Size 219B
SHA256 eaec5b770614773b15b17b422f32d63c7cfecf26ade3a24603c38276a5b250d6
MD5 a3e200a6f2b86c6bd8e7fb067dee1aab
SHA1 b24ed356cf18d1b8993f805d523a3738d3631103
SHA512 118c00698f19b6029e2f23b0f63c6cc28f5719c74199e9aa4e76e874d507052bc39618f8f580d34483ef82599ae99cf5d9d66344b62fff3f1da312d96e41fe74
TLSH
T1D2D0237341715520E914ADF4DA7F819DC703D16DC9EC41D1C02434E250005F2A74C540
MD5 SHA1 SHA512 TLSH

Submit Download

8b4b04f94142c7d0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b4b04f94142c7d0_0
Size 216B
SHA256 079f43e00b6fa6e1d7e6b5fa1c4e492afc75587bd3a5a1795e6754168f5ad337
MD5 4e0f25e24fe2aab73018461491257b63
SHA1 1e7c32704dabbdc014fd4d0da7bfe1056b1e4e23
SHA512 9b983a348ee1ab1acc63a62d42eaa22f7b1e48a0a2d0af7a6d9e113531e7fbf15c9305a576fe932907137cc97fa6fce99428357e2566b3a9f3c71c7b71a57217
TLSH
T125D022BB18122920CF0D08F8CF3FE00A870AE29CC6848282081290EA32168F36609921
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 92fa40263576ce842ef9910da2b9ffb4b9a949fef7e2f49d5dc276ab493e4e3e
MD5 3268d792a8270b106a1e10dda73f6a99
SHA1 9a4ec99c8cd418b69de0111c696abf8570f5fb7f
SHA512 35b3cb1d887b397cf211e968b2c9e416a33d283e852e48a869007fdc52ba6a66c329aee37acba6d1dc1d25160a99b3890a5978ea3eb0b8b87b4904754633e261
SSDEEP 96:g07QSYAU2QnoFL/2MOjgF7z//YJwjGfQ9g:g0+AU2QnoFL/2Myg1sSjGfJ
TLSH
T12281D91503A634D4FB96003DB6E25A77F073C0D4887F1E925DD0A7B919D67BF52D2018
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe587a9a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587a9a.TMP
Size 3KB
SHA256 8d34243784a2a74844ff3a366da0dbfa5a4e8a84ac6844147ebdbb7a3a3aab67
MD5 a6cac3429f9e981651a7188c4900afdb
SHA1 6cd0f10a9fc76c6b9b6ef0761172d11c3fb6f1fb
SHA512 b5467fc8bfadf9073d6398c931b073f406904fb6d0c3f5930056f1ff3f72c5feab89964f921313fa23c5e12db4d2f3a1b655644ecf7432b3c9b7ec4565e32ed4
TLSH
T190711C19039A34E4F7D1117DB7D186A3F573C1D5087F2D624AD09B7129EAB3F52E1004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 bafa450ae2101312b885713165c5bcf4e95c27f0c1f2a1100b01452e5fb82bc7
MD5 e4ca2e15f8b32bf8af7b82ee92e34ce9
SHA1 8536463de37c3607b3cac927d1860c3a11dd7548
SHA512 08dfe9b9515c2d1f51af0d95e1732d07d4e1b754503a148bf42fbc48337127805e59198bf5b739fb925bb983a8cf253c15406d919a9b520b891872b5137bc7ea
SSDEEP 96:D1WfOVpZA+Zp+Wmeaaij60WszFCW5fIoWJCMXfW3hs4x7tHWVptiGwe3Wer:D1hVpXrdmeaaij60FJCAfIoQCKfOyS7e
TLSH
T103C1C0E7D7E4953DCD2296F0AA156E2FCD7D0D1493183D6A89E8EF0B63E2071E20194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 27b2e02bcccc49a75921f1b7f47bbbfaedf9830b852794ff7a33453c64a5cf55
MD5 7adab09e9ce3616ca110a31bdbda3856
SHA1 9cccbda4577d1ebfe779181c6522bea69954c323
SHA512 9304a6b88ba2924e430286bd282e7bd3567f25a3de95f3e78b0ec8523fb4be71ef5bae24a969d77d859685d3f0a45c82f8c08fe04a0d91e428bcc19788e0e26b
SSDEEP 192:sxZsRcyMqZjK1Ml8MFm/fTsmCAlKQ7Pb0Ezodp4j/W6+WN8o2/Y0Z+UJa1IgjJHJ:sxZspdm/fTsmCuV7z03G/b+/5cjJp
TLSH
T11D62F8166A385D778CDBD209FA55BB93D3F9156392904E44AAFC8B0C05E7ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c40175d4e6217c71d4f186f76ee3ce6241e46611fcaa1d0bf01080f88776c515
MD5 3db7134357a4e17f837536597152c0dd
SHA1 fa72be721346c2b73c70e797b5be68b6f9a5ad05
SHA512 31847c9897b6ef65f75948e801deaa3ab715f3f074347f584602418ab8fac006ab5d312083b7510dabcecb6ebd4129b90fe8ad29d2e4dc8a7fc63ca65548ecc1
SSDEEP 192:sxZsRcyMqZjK1Ml8UQiFm/fTsOCAgKQ7Pb0Ezodp4j/W6+WN8o2/Y0ZGy1a1Ig5O:sxZspqom/fTsOCrV7z03G/b+/5YEJp
TLSH
T1D362E8166A385A77CCDBD219FA55BB93D3F9156392904E44A9FC8B0C01E7ADD220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 8652f2bb7385ec578c6649d0940f80691484a1b69d80c0b2c794c8f774c3b5e3
MD5 d51792b63ed3ba1de7e48851e2ecbcb9
SHA1 441158678a38e65a5837887ae322829c74aa752d
SHA512 468d51f64995a86b8c72048d3fe0014e3cad088e553e92f24ae91a3986ac987584f131594b5bfde63b68ca46b72748b9528957f737e8af7a0fc7e1752d42c053
SSDEEP 768:XwZh38Dv2aFWRm6GQXm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro15:XwZh38Dv2aFWRm6GQXmu1jaK09LplMbH
TLSH
T13AE21B3B280CC77E4F844E9DEC26AF966ED802CB66684D5447FA494C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fca650f7ddef156b66998409b0d25a589a7174c7f21c982401cfe5ffef99a8af
MD5 7d9f1774edd2e3d96a515da50dee86cb
SHA1 8533ec32f737c0ee102938b55914836d50840ce7
SHA512 ab420a4cd1400c69a1c42877edeb95978049ad1286f197185f7fee759ccc83631e78d6f26942f87ac2a4efcaaeab75f2f0bf85b61fd8aaaa0e866fd2700fada4
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjllpfo:ctGj+BCNC5qFVpKxlho
TLSH
T121B2581632BA02023C3E791D87E597371A42B2633058E93B7BE854B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7b87cc369fe04c829108c20c4e6c47be5497a90508b2305cdbde38f728a90e37
MD5 35c33c59057649776e2063c6252783ee
SHA1 ebfa486aaf3e0fd10690e4e82cc41000d89084d4
SHA512 ede65df3a866518f3b334af93bf882d75f8eaeb263533bb0d560e92595331b37faf10452a05e9bdf9307516b8bffe474c8c321f88a730e38080febb297dc6a5e
SSDEEP 384:nziF9CcmyWCs38NL8TUNTUlIxBrk6vIDR1zCfbLoND7jUIXQRX8e4KV8p0bOty/o:eFccps38wg4xDnOoNDBQRMI8p0s
TLSH
T1FCC26C36D8A8CAABECD64F99E74A3503DEE04263C68C9AD4D9DC1E0D009B19D530F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a28a39812bda884bf30f9fa3b956c382965176074368137cce3c5971684b4b09
MD5 4df6699ae941ff7297fb558c388269f8
SHA1 523a5e2bfb5e33084b01936aa0951a8a0e2b3237
SHA512 1c9803c2be9ebb78bb4ccb85469fc8f17e7ec6a6c435f9022cf4a6338a6c6ca10ce6dc8ece58f5b1afb26424ab78e783650e1f42159f9bd2035fd4377fbacf77
SSDEEP 384:nTiFYurQXjZxh6VK38N/8TUNTUlIRErk6tFk1zCfbLoND7jUIXQKX8lw1a1PmPby:+FYur0h6o3swgJG+OoNDBQKMlw1a1Cby
TLSH
T1EBD25A36E8A8DAA7ADD64ED9F35A7647DFF00153858C9AC8E9D81E0C00DB19D530FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 04b9f242cc80da1d0735a080e6c1f386d371a1ca0c3ec9804c35aa20bb0c9244
MD5 608f57f21292ac1b7d5471f35ee9dace
SHA1 3a46bca45eb4800836d0e699ee0e5384067f3423
SHA512 9d157dac102aad0abe205906c64b70677d302c49054da9b0d4f974d3a33798f430a09f0676c4264cffb45e86d12a5140a261168b7b262894695d700e113b1754
SSDEEP 384:noiFYurQXjZxh6VK38N/8TUNTUlIRErk6tFk1zCfbLoND7jUIXQKX8lw1a1PmPby:zFYur0h6o3swgJG+OoNDBQKMlw1a1Cby
TLSH
T128D25A36ECA8DAA7ADD64ED9F25A7647DFF00153858C9AC8E9D81E0C00DB19D530FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 983d6378e15c4b871fb80fadc9d2fc9f45952d100c6c318a61fd4287585014d9
MD5 534119f55ae6c7c7bcaab165fef4e15d
SHA1 fd72b412e3139119697596c5fc65881cde2cdfe9
SHA512 056c9a74ada6c9b764affd926b409e3395ce23026858c0651c641201e40736bf621c88da5a62b5a02dc0fe3574b504229e57c6194d8efe445fa0a8c50fb5ab13
SSDEEP 384:nTiF1urQXjZxh6Vn38N/8TUNTUlIRgrk60Fk1zCfbLoND7jUIXQKX8lw1a1PmPby:+F1ur0h6F3swgJ5+OoNDBQKMlw1a1Cby
TLSH
T152D25B36E8A8DA77ADD64ED9F74A7647DEF00153858C9AC8E9D81E0C00DB19D530FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 29027dc47962f5602877bb0c3670cc3176483e492507376bd3069f67156faf3e
MD5 5188d3afd625efc41fc3e5bcdf10e04f
SHA1 6d9d503e5513facc0ef07b22b7a6e01e759e146b
SHA512 6b60210b01fc4586b7042f38eb21bcaca20b3450d49e962d30cbb7b8ea459c6ee71cd229d7ee6cf57c94961a516c25b6df4431197cfe8b5e84046263e5dbe8cf
SSDEEP 768:UFYur0h6eJ3swgJc+OoNDBMqMlw1a1Cby:E+dJ3aJKF+Vy
TLSH
T19CE2C4F698E78977E99E4B97A37D2D429AFCC153B5884584BBC80D0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 66ca201714bd0614477cace3d76351c497b412562c8fb51297bd80efe14f9c01
MD5 e11b1db672de33993a47c5eaf8c7acf6
SHA1 070309321b0989f2accaaaebccf87004f199f265
SHA512 69d22c2a431664bf232f7a05afdf11604804d01d2ae87337a853b54c4310e43b2d1c2f54b334d4dd2628fad31b3dffd7053d232a50629870213ecae9baeb6ed6
SSDEEP 384:nMiF9CcmyWCs38NN8TUNTUlIxBrk6oalF1zCfbLoND7jUGSXse4KV8p0bOty/7IV:3Fccps3mwg4OlzOoNDXS8I8p0s
TLSH
T19DB25B36ECA9CABBEDE64F99F74E6603DEE01163C58C9AD4DAD81D0D008719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4004-402-0x0000021ABB3E0000-0x0000021ABC3E0000-memory.dmp

Download