3b505ab2eeb58bba9135fae041d67c2e4414269768e8a3c95f166719569c01f3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
never-have-i-ever.html
Size 12KB
Sample260805-wzerysdp21
SHA256 3b505ab2eeb58bba9135fae041d67c2e4414269768e8a3c95f166719569c01f3
MD5 f19c7d877bc8bf68763cd8d225a25783
SHA1 1357a0e71211a42a035ae6d7ec9a63de5cd61a6d
SHA512 b2906c6c9ed34fc3db96e1591bd804fe8e95a9d9bdec6a13127398d2aaa8b2f487aa8fa6c01c1dc609c95cbc7bbdeec646432d7a52f7701a7952526e17371b35
SSDEEP 384:1/3AYUVj5L8UkU43g9fhWCYnTweNY3CABn8BgK/An+Kk4JVDxg:OZRog9f4CYgW
TLSH
T1834219296F8D5C3F020343D6B0587A8BB57F9D39C6144F42B5FF495A63E0E86A02764B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3512	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304277026123908"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{762CFD51-1B88-4F72-AEF6-C973A949B743}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2492	2180	msedge.exe	86
PID 2180 wrote to memory of 3512	2180	msedge.exe	87
PID 2180 wrote to memory of 5044	2180	msedge.exe	88
PID 2180 wrote to memory of 5044	2180	msedge.exe	88
PID 2180 wrote to memory of 5044	2180	msedge.exe	88
PID 2180 wrote to memory of 3968	2180	msedge.exe	89
PID 2180 wrote to memory of 3968	2180	msedge.exe	89
PID 2180 wrote to memory of 1388	2180	msedge.exe	90
PID 2180 wrote to memory of 752	2180	msedge.exe	91
PID 2180 wrote to memory of 1388	2180	msedge.exe	90
PID 2180 wrote to memory of 1388	2180	msedge.exe	90
PID 2180 wrote to memory of 752	2180	msedge.exe	91
PID 2180 wrote to memory of 752	2180	msedge.exe	91
PID 2180 wrote to memory of 1632	2180	msedge.exe	92
PID 2180 wrote to memory of 3372	2180	msedge.exe	93
PID 2180 wrote to memory of 1632	2180	msedge.exe	92
PID 2180 wrote to memory of 1632	2180	msedge.exe	92
PID 2180 wrote to memory of 3372	2180	msedge.exe	93
PID 2180 wrote to memory of 3372	2180	msedge.exe	93
PID 2180 wrote to memory of 3528	2180	msedge.exe	97
PID 2180 wrote to memory of 4412	2180	msedge.exe	98
PID 2180 wrote to memory of 3528	2180	msedge.exe	97
PID 2180 wrote to memory of 4412	2180	msedge.exe	98
PID 2180 wrote to memory of 3432	2180	msedge.exe	100
PID 2180 wrote to memory of 1084	2180	msedge.exe	103
PID 2180 wrote to memory of 4220	2180	msedge.exe	104
PID 2180 wrote to memory of 2416	2180	msedge.exe	105
PID 2180 wrote to memory of 4332	2180	msedge.exe	112
PID 2180 wrote to memory of 4332	2180	msedge.exe	112
PID 2180 wrote to memory of 3304	2180	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\never-have-i-ever.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff95724c188,0x7ff95724c194,0x7ff95724c1a0
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,13478634189649330757,5346205309913939666,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,12164400337164564018,8687008548095890866,262144 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,12437248594956091800,2216905999304401014,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,11250401347768841544,14994009135993480784,2097152 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,9878630741820040953,5593194744453096567,2097152 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,16147002669904905290,976854299312846654,2097152 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,5450455946015654007,2696677980349086304,2097152 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2848023910487566662,11947735055006346004,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5091008932125410584,15455311873561305290,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5160937810414167144,3245536911183475875,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5160937810414167144,3245536911183475875,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,15624521711098048032,2545208148259865085,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,1242563993798820945,9379584120453734632,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,18352200602878894938,4431006635779996952,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14316789589015026726,13378646961793612450,524288 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4236,i,11461579021871525551,16557145581923016784,262144 --field-trial-handle=2340,i,8774679598177860378,9653353595950024046,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f81f681-0619-4b81-a1ec-8f9b5074f980.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f81f681-0619-4b81-a1ec-8f9b5074f980.tmp
Size 8KB
SHA256 f72fb001a0abaec4aced28adf4203ee492842c3ef7f9eeed4ccc7dd75bd6d967
MD5 5daa455d841ba49d85574ded418d14af
SHA1 29268bd595f8cb55f9b0d911c4f414f43807025f
SHA512 775bb687c04f755c3a625eba6c45d75f3fe9b4770294baf05e6a52264d224a8c714b65b703eca2990d6a9e75d296cf63497897c0aba50a0e48d28e3104786daf
SSDEEP 192:tONg6JkRtQmiUygsW+RNwOmhOmQh3iRQU6:tONg6UrMW+RNwOW09U6
TLSH
T17902D835A9382C779EF26E4AB54B27175FA4212BF9852F80DAD81F1C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 caadfb5d2905fc87eba0a52914f97fd6d95b126be7e309941cc208a5b1a8ac1e
MD5 95f6bf56b921aae49ff54366391b90d6
SHA1 468c8e95daa97fa2b8e0e9c14c42e9fcb9654e77
SHA512 e7e3724927113bd4652e6ad40e2822b69b49e882bd98d474207b4c9b254a3177a35e6cf5dfe7ca8d2a8a9737965b4c3ad986cb2ebc31899f1aff8c233ea538c1
TLSH
T13C71513B126209BAD3AA8033D0F323413577AAEAF4235E5917708CB76634B52B15957D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5dd1d0dfdacb450deab12480479858e361ff8af7436934519bbb9fa3a7716951
MD5 4e8c02fc1304394b7e159cda46016c1d
SHA1 8d83301deeb5265203039515dc111a427aa4b646
SHA512 8f34e656eb55465137eae6d756a4e88386047e84aa4ead7f29fb819b70388a9c44ae4c874df357d68e9ea9b6ad8e4346715d9ff77f98d5acf57afacfcde5708a
TLSH
T10211BDF3C3D5956E8D0156F05A24AE2BCE2D0602421C3C1689D4FF2B83F3075E10256F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 21b69c271cc156356fed8e970ca3ce7440de7a333c946969655dfa2551c53d4e
MD5 3fa73e94c138a08922928d542c4c15f8
SHA1 593d9b8eccde931566a7a94282a3613d847b3471
SHA512 902d0cc7fc4502feb2f99c643445123288da0e5c6203359efcea507322e14e6ebf1f535a798f4b260166c934110aa7b13aabacde0c3391de2f2091a58f95c404
SSDEEP 192:sxZKRlyM/jK1Ml8Mkj/fQst7NlIdpdfHW6+WNGYIkfuSIgrJ:sxZKvMj/fQst7NWpHbGa9
TLSH
T18042F8016B386977CCCBD309FA457F53D6F94572A2900E44A9FCDA1C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 412586b7191ca8bc33050de9c935cfec6623c0f3bf2d11d7d74b368a769d336a
MD5 565501dcf4dd6b40e880634d927eabb3
SHA1 356d30391010c1c21d3808f9e28741f76c6a2d46
SHA512 ed05dbb32426190030ed8b3b8043385e5e1b880d562f9864502275bcf2bbe747277bd4381dc50265b1c9623ee90caa2ae8f4a66f1a14cfa57f49576304ec87f1
SSDEEP 192:sxZKRlyM/jK1Ml8UQVkj/fQs4GNlIdpHfHW6+WNGYIlyoSIg5cJ:sxZKvqej/fQs4GNW/HbGKa
TLSH
T1EF52F812AA385977CCDBD20DFA457F53D6F44573A2900E44A9FCDA1C05E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b497939134e578bb669a15da34bf6c2fdbb5bb1a0ac3e1da4e274833f5b1b423
MD5 45dcc944e1bd9447dbba6f9067c8c2b6
SHA1 31af2f94fe152611f5b964eee91f20be536a7f9a
SHA512 2dbf08c70a926fddd414f39ac6e3ac9775798b20f4d75468af4ec547e42eb12addbe4f5a41a0898f3d79cf4645918f148cebdaaee92a5744141d87593e49cf83
SSDEEP 768:1FsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9EroNSC:1FsqxXlWvJD6Tu1ja54LAs9PNh
TLSH
T150D21B3B694CC77E4F840E6DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 22cd9b510a8de541874b19f9158e4f6d5b7f1349ea6b6b96a904cee807fd25aa
MD5 52bc0bca9136312fafa6bf8d6b8242fe
SHA1 2a9f9e88cd214b93be279738744cc9ce82c46dff
SHA512 45c0cc1f0ab4ebdba6df8cdc928746c219618d41216a50c683b188857173f0db3223f62df6b24d5afe8eb0b88fd48b66634b41211cd8929483730592fad7244e
SSDEEP 96:KYbaKYIK6m0Knq6+HuKYYj5uKiYCiE4KxCd:ExX/l9Zfy
TLSH
T17CE10202717F02033ABD7908A3AA89374E4275A37418A4BF3B7955664EB7E111CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593138.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593138.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 718141bcffaed7107aa07f5695e382191554e4e51230d2c687c79aef20fbffe2
MD5 0ed3fe77c1ac5be91edf3b91dadf891e
SHA1 2aee9c390fd409070af425bfd110e2281bb44e50
SHA512 edbcad61d5c5eee9bfb524aea85b6d8db58e3ebc739e0bb8cce99154dde702a2db39896fbf269177781fda8708cbcb8ca6ed45f0f8ba6d7e9c1ecfd4f93387b9
SSDEEP 384:0ZcIhsNMp5hbQFf4VRNwOWG9J/8BeRs9JKgqijUThOGT:yh6fuHwOp9Z8TjKgqmUThOGT
TLSH
T12A928D3168385D7B9EE2B481F64B36174FF89127E6C42FD491ECAF0C02DB99C231A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ac9d1cccbc2ad525e17b5c79193c732529bb6db2bcd478db9ad281a9b1499fd9
MD5 19cbc4b9ea30592bd243b66e22a6d9ad
SHA1 5f94766996accfe7170765c2e0628ff3ec228ef1
SHA512 65393f8c8b8136b69cb756003cb35bf7d0bd74e524561c816f02aa59054a1b11a08802ed867f91b918803ba4e6d933e683a709ef441d4e0ceb00050ea9cb9554
SSDEEP 384:ziFiZcIGzsNE8TUNTUlIlo5hbQFf4VRNwOWG9J28BeRs9JKgqijUThOGT:eFQ21wgvfuHwOp948TjKgqmUThOGT
TLSH
T1D0A27D325868897BEEF6AA81F64B32178EF44177D6C56E90E2DCAE0C01DB5DC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 358fecf4128afc0b4a349ae458da9327374a1ab24e605d87056a8631c00b9fe2
MD5 37c4981b8c10fdec62cc411c39cf97f7
SHA1 606ce82f64bd85f04d6a129cd3ff426c5bc8752d
SHA512 4f3e4175e81ac51bce00bcbb8e98e1f793cba087be9b12ea8bcdf48c8bb247c416117ef59315ce576e9dd069184f53e57c9e39cddea11e71a7d96d797d4e7936
SSDEEP 384:5ZcIhsNMo5hbQFf4VRNwOWG9J/8BeRs9JKgqijUThOGT:RhZfuHwOp9Z8TjKgqmUThOGT
TLSH
T14D928C3168385D7B9EE2B481F64B36174FF89127E6C42FD491ECAF0D02DB99C231A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 644e689f81be99e32caa1d3c808a965e5f34b9c12a96869e9efb1b55fc3936aa
MD5 ef3fec9c001bcd276ad1693f99373a05
SHA1 a300ebafdf36e9bd53ce50f4a32548ce93d71779
SHA512 8a556e054ab7965c015b19b1cbd7ad0bbdd05f3f2a96df35344653916f454d71e0e637fe5746f2e9c9478157633aeda16ba6b5b376570731758bf5ad4d396710
SSDEEP 192:wONd6JkRMQmiUyasA+RNwOmhOmVU9DFyVcaqoPU6:wONd6UcYA+RNwOWG9JV8U6
TLSH
T168122A3178385C7B5EE26455F58B36134EA5512BFA893FC0D5DC2E1C02EFA9C234AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7a99fd6-8f80-4645-ac91-eb35c000c217.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7a99fd6-8f80-4645-ac91-eb35c000c217.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2a12b6d9876b7ad38d883e6217bec0caab6a2def874fdb17108d6e5a08f4037
MD5 1e88079c323ef82091fb2f629cefd965
SHA1 7d162bef207c217051bda338be8a869c9c6621cd
SHA512 a7df8db2a21ca959dfa25d9bc2ee49a2efa3d582bcae21e3ba55cec35c56f52f49441b5fa990f2a634408f127f9cb5e67bf563971eb94a24a3e9bb71f7afd927
TLSH
T108412D59B6EA1108B3B77F5A9BF7A8AE447FB8372F4AD05D10110D4E0A26A40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download