c0960c391b3900d64233ce98fa2fa0d609f77cd56b0483c7a9d13e796fe67503

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sea-waybill.html
Size 438B
Sample260707-pezhashv3v
SHA256 c0960c391b3900d64233ce98fa2fa0d609f77cd56b0483c7a9d13e796fe67503
MD5 8d70a80cc5b3ad1153af7ae8537106b3
SHA1 79df22abefd41853269856dcb97a2a128df2a974
SHA512 96e71b978000c5fe97d402ff9af19a6870f58bb6ff6f6a74a6d0d62f0d74793bd84787e27765343770b93b0cf5eab668d6f38ae7641fab8a344f6d31ae5137e0
TLSH
T1E6F0ABDBD831000E89193B0F632AC728BB0B18D4A35EF3AB1661C3A10142DFC1E8BC88
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5508	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{1EE0EA16-9054-478B-BEDD-B35A65EDE127}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 5960	1004	msedge.exe	88
PID 1004 wrote to memory of 1212	1004	msedge.exe	89
PID 1004 wrote to memory of 5508	1004	msedge.exe	90
PID 1004 wrote to memory of 1212	1004	msedge.exe	89
PID 1004 wrote to memory of 1212	1004	msedge.exe	89
PID 1004 wrote to memory of 5016	1004	msedge.exe	92
PID 1004 wrote to memory of 5016	1004	msedge.exe	92
PID 1004 wrote to memory of 3184	1004	msedge.exe	93
PID 1004 wrote to memory of 3184	1004	msedge.exe	93
PID 1004 wrote to memory of 3184	1004	msedge.exe	93
PID 1004 wrote to memory of 2796	1004	msedge.exe	94
PID 1004 wrote to memory of 2796	1004	msedge.exe	94
PID 1004 wrote to memory of 2796	1004	msedge.exe	94
PID 1004 wrote to memory of 5268	1004	msedge.exe	96
PID 1004 wrote to memory of 3964	1004	msedge.exe	95
PID 1004 wrote to memory of 3964	1004	msedge.exe	95
PID 1004 wrote to memory of 3964	1004	msedge.exe	95
PID 1004 wrote to memory of 5268	1004	msedge.exe	96
PID 1004 wrote to memory of 5268	1004	msedge.exe	96
PID 1004 wrote to memory of 3180	1004	msedge.exe	99
PID 1004 wrote to memory of 6112	1004	msedge.exe	98
PID 1004 wrote to memory of 3180	1004	msedge.exe	99
PID 1004 wrote to memory of 6112	1004	msedge.exe	98
PID 1004 wrote to memory of 4268	1004	msedge.exe	101
PID 1004 wrote to memory of 1668	1004	msedge.exe	105
PID 1004 wrote to memory of 4792	1004	msedge.exe	106
PID 1004 wrote to memory of 1692	1004	msedge.exe	107
PID 1004 wrote to memory of 1360	1004	msedge.exe	108
PID 1004 wrote to memory of 1360	1004	msedge.exe	108
PID 1004 wrote to memory of 1892	1004	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sea-waybill.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff8d26ac188,0x7ff8d26ac194,0x7ff8d26ac1a0
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,17917459362215530378,16863869789279189784,262144 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,11615911098094606385,17975646081285891026,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,3614959895051097309,16326481039851217932,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,9970208949650747660,14029944705265660054,2097152 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,14275222132733066064,10929215379845234561,2097152 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,3987385402881287015,16692303010638485742,2097152 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,14691700477392063901,16263932026691718132,2097152 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15745108305425253442,14204393122263784723,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12925011047426911600,16069083181703484198,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,3880530170499613942,6560137439165173493,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,3880530170499613942,6560137439165173493,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8325536476910349755,10405570018676605725,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,18054741336327174369,1974059736728128534,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,10076454452925240855,8804522586054557441,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,13922466645304133706,8181491634380244948,524288 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5580,i,8529089384902654808,2247818950952492122,262144 --field-trial-handle=2280,i,10526937985300512348,12991455495217370332,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04de10cb82930e79f08535d557f64ac9621c6cda1d0eccfac6473c0104a0d637
MD5 dea6cb2606db8cdd2fabbd87e0a40db7
SHA1 c2098eca31b6920f57a11bd7cba61a0b491c4813
SHA512 f6292db5c9d79125ec3a39855ecfc244c3c4923eb58b067d4b707a04d5db627e491e5e836c8b067160f89ccf33eb15dca3b9d7fff40fd18590bc2a2ca2ba56e2
TLSH
T1C6D09B557244A94BCB81217235D4B2555214946654150658055171B8C9F62D305BB8ED
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5eeca2aa6e917b76d239047f52a1c2b6b37364fe74e84180ac7fdc9548b3be90
MD5 a153df1b2dbe0717abacfb5c09939775
SHA1 91c63971114b63dacf725afb7452bd3a26feb97e
SHA512 79f36c0948649f3fad8501147974bd9fd20b8a31fdfc130e22546c6adb15a9ea187ca804e252771bfe133494aa84c78a92d9352ebb50e60be11ddd64e17fcbcc
TLSH
T1DED09266B254A84BCB81217639E9B255A2189466401A0A580662B2B8C9F62D306BB8EA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5c551efd1992899dd4d65aa8db90014f8399adc5553eb1068a8e8c10db8759f5
MD5 00561789e2353d56f74c12067c3c470c
SHA1 333065bbaf48579e7ed4b8034e2e6b2d994b9c51
SHA512 26998bd4dffc091c2a8b95ef5f1b41878a7e5888398a65d045aadaae234c4589d3be2e05624e9704b4d3a1a52ee014ce8aaed1129926d1b47bf7ce42429356a9
TLSH
T14C511F5513B7CBF1DBA95DBA10E16289367384DA016B7F30D060EF3349D63B4D6429B0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a0ebd1a0cb0608b0f8bcd9aa8f234cd587e83ca88aaaf8bfffda5cc78bde141c
MD5 11bde1f79df11d73ff0f18afc0f2dc7c
SHA1 6e734429e35b1ae8e391c73fc883351e787d80a1
SHA512 7eaaad76ee7c6ce9084ff9b4638b38e342f8596267232a85cd8de084f1fd9faa92d30c816d18d2e7c66ee6a1c0eabb130d5babf8b9975f5c01f3c91fdc576443
TLSH
T1E441ACF3C3E4866EC91156F0AA146E1FCE1D0915832C3C6A89E4EF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 792bf9257b1b133f2356730c1ffae20dcb5764034193e6a854e565608e211125
MD5 cc853b496f6d208cf7e4ff7a07219fa7
SHA1 01953dd0cc926d3fd0f4b89dd92d6d68551f6a7d
SHA512 21f92a41f5d9a12c4cfe7a5df7fb1f1b1114e7917d7c2f8cf6baa518fc7c65030228db366afcf75e21d37b83128e9fa4c4fedccf48ec5fb20f13e633e03dc660
SSDEEP 192:sxRfRwyM/jK1Ml8wbt/fCsSsIw3WRvzoA8p4Y/g6+WNIYaubHGFIgIJ:sxRfalt/fCs3HJZ/5Isss
TLSH
T15452DA166634997BCCDBD20DFA557F53D6F91463A2901E04AAFCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5510a72a4905dd9a151b0c08a68e45b9ee8f3736534b667e9d8417a1886f3f28
MD5 68e149a3c292247850b8e9167e93c937
SHA1 d0d5d9d1cee4566cbb577c3e8a903d1f82fa3494
SHA512 d2f7302d1b8fb75711b955b8ad6eb0218f82ed9735098eb2d8277c8e7ae56b9cd3e282be9b4aa96a4fe47a574c1daf8a24b8dee71ff5c6f31ae20231adb5a0dd
SSDEEP 192:sxRwRwyM/jK1Ml8UQjbt/fCsfsIw3WRvzoA8peY/g6+WNIYaobHGFIgDDJ:sxRwaq3t/fCskHJ3/5Imsh
TLSH
T1D862D816A634997BCCDBD20DFA557F53D6F95463A2900E04AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bd7faaf4c37b4da9ffc6efa0462872db56fedaf8bfa97f4be04617d46938475c
MD5 7452d818f3cd26c541d651150f60464a
SHA1 742177707f348288e0d19693ac6711a0ff169720
SHA512 28ea9b9f5816f0bdf28e5e9afe897877b342300792a77d40fae51005cc1bd927d694edea80bc0c2befdbffcbfc7a95b43ed284e916499a785ca0f0d855649a1f
SSDEEP 192:sxRwRwyM/jK1Ml8wbt/fCsfsIw3WRvzoA8p4Y/g6+WNIYaubHGFIgDDJ:sxRwalt/fCskHJZ/5Issh
TLSH
T17252D916A634997BCCDBD20DFA557F53D6F91463A2901E04AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 806d86c8196f17f45194aab8588c69003cf1c840fe3e3a6872d21a7745fb7a85
MD5 46f7366310cde002534a8cda77e9f73d
SHA1 a0217061d59c85e7761bbaf7ce985fae8998a1d8
SHA512 9c49c7f1c77901018bebd1c005ad5a2ed9f5657abdb02cf64ce243712a2bbd423aab3aa02c30905062478079201579c3b7a5c577807ed4fc39c56c3daade30f1
SSDEEP 768:nTSdOFWg+wfla8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPB0UgroKG:nTSdOFWg+wflau1jaamUr5
TLSH
T1B6C21C2B240CC77E4F845E6DEC29AE96ADD801CB5B984D5447FA880C03CB7EF521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 87df21f7591a5e5d207d38ca2cbca8d8ae7c62dd222a4bbcf7119170c2c79028
MD5 b5076c8965c2fa7a2d72f4fe9fc80286
SHA1 bff626cf4f1f5034cf4fc6c5c00b401051f34d2a
SHA512 96633e6d1b234f00edc8372cc7ef7bbf7a04e5b5a2f5fb2dd6ce3a73d935c5d3fdf33d57a09515dbb155a5b65b3d99b4ffc9d4877184462906f58935fcc42c24
SSDEEP 96:KRzc5t7xxNWlqggVNK4sg7NcD7SFR2H2r6WwYY+Wo9lg2+K4Lgk+ce2VUGDMpdLJ:Czc5t7xxolqxVHsg7iD7SFR2H2r6WwYJ
TLSH
T12B912305727B0780397E784891E4A967C6D370A23119A42F3BA842E35F67E039EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a8f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a8f8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2a78ebd0284a669077b7f9710644d2a0ecb982ca571a16374110cfd88d131b7f
MD5 52595592a65d4a9016e07976a6fad99a
SHA1 d6267d77320dd88ad643f054363280737a463293
SHA512 ff04e3b23ac9d86fa60ca778fb3f0ece64f1e17681f1f8f42c6305c079a29f8c5583a7e12720246251ed9ede59041749d6513b8f479a789157acc4c2d47afe1b
SSDEEP 768:srv+4UNbd23rvIU65LBE93XVGRh9zb3bmlf53z:sbsbA3rvK89nVG1zal
TLSH
T15803AE31A578A8738CF78684B10B3603BFF411679AC54A88D8ED6F8D428F58D771BD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5ff186becf10a46767d21f5d9e528323fd08a8cf26b915c0b6e4873668c59f58
MD5 edc6063ba2c2dff1c9fe29f2b540ba2e
SHA1 772ea1a2c59d8afd75bb703063473aaf1a0285a8
SHA512 e7b99b45ef3283e6be448da8fcb06492a9ac2887c779c984d28c0ecc9022746d0679e1293eb40f4c0e580a7c0373f698a5dcc11306cfd4c32fad0aa41dcf5bc6
SSDEEP 768:trv+4UNbdi3qIQ05LBy93XVGRh9zb3bm54eVH1S7E:tbsbE3qMq9nVG1zVEH15
TLSH
T19E03BF32A8B899738CF78684B10B36077FB85167D6C50A88D8ED2F4D439F58D670B963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 43b19fa96d00ca2166a2dc3e8cf4fcae161cb5b4f3a79572e516d53a5ad3437e
MD5 eb168b95ffa14dc07d4a8de870292760
SHA1 1f5d76196cb3370ea1337d2f8d6f4617c799b2e4
SHA512 a26f6a7cda58d5ebcedfdfd9cfed1c8f4b132da45f3badc8e552a7ff7c4c7ab323310594176b00e617cf14562c2d28fd8a71bbd4afab6d0442527fb1810c3f0a
SSDEEP 768:9j+9c3rvIHU65LBE93XVGRh9zb3bmlfb9ME:49c3rvkR89nVG1zab+E
TLSH
T1EEF2AF3198659D738CE68694B20B3617EFF44277D6C91D4CD9EDAF4D02CB68CA713812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d42fda0364707b43b889f34bfbafe96055e9bae9e45b3dd12c0a1127c0dd3553
MD5 b27d6c9646b3ea48cad035f1929a28ee
SHA1 d75634dcf7851512b0e4041fb9af71c5f305f7ae
SHA512 8163adc91aea2fb237917b5eebafb02a2eca286390e3f076ec743bc97a883a4d0d07d7331b11b4fa2ef67d12fce87f92f9c5b674d4b29cc3ae0b26a8cec39c52
SSDEEP 768:oF1j+9c30wgxvIHU65LBy93XVGRh9zb3bmlfb9ME:F9c3MvkRa9nVG1zab+E
TLSH
T12203AE3298A4D9778CE68B98F20B3617EFF042B7D6C55948EAEDAF4D028B58C5703C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b54875f9-31ad-4b8b-9d5c-13b2a4cf9f60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b54875f9-31ad-4b8b-9d5c-13b2a4cf9f60.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download