3b505ab2eeb58bba9135fae041d67c2e4414269768e8a3c95f166719569c01f3

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
never-have-i-ever.html
Size 12KB
Sample260805-wzerysdp21
SHA256 3b505ab2eeb58bba9135fae041d67c2e4414269768e8a3c95f166719569c01f3
MD5 f19c7d877bc8bf68763cd8d225a25783
SHA1 1357a0e71211a42a035ae6d7ec9a63de5cd61a6d
SHA512 b2906c6c9ed34fc3db96e1591bd804fe8e95a9d9bdec6a13127398d2aaa8b2f487aa8fa6c01c1dc609c95cbc7bbdeec646432d7a52f7701a7952526e17371b35
SSDEEP 384:1/3AYUVj5L8UkU43g9fhWCYnTweNY3CABn8BgK/An+Kk4JVDxg:OZRog9f4CYgW
TLSH
T1834219296F8D5C3F020343D6B0587A8BB57F9D39C6144F42B5FF495A63E0E86A02764B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304277054686469"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{21568543-DBD2-49BD-93AF-DA61A9EBF53F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 3224	2892	msedge.exe	88
PID 2892 wrote to memory of 2404	2892	msedge.exe	90
PID 2892 wrote to memory of 4312	2892	msedge.exe	91
PID 2892 wrote to memory of 2404	2892	msedge.exe	90
PID 2892 wrote to memory of 2404	2892	msedge.exe	90
PID 2892 wrote to memory of 3148	2892	msedge.exe	92
PID 2892 wrote to memory of 3148	2892	msedge.exe	92
PID 2892 wrote to memory of 364	2892	msedge.exe	95
PID 2892 wrote to memory of 2452	2892	msedge.exe	94
PID 2892 wrote to memory of 2452	2892	msedge.exe	94
PID 2892 wrote to memory of 2452	2892	msedge.exe	94
PID 2892 wrote to memory of 364	2892	msedge.exe	95
PID 2892 wrote to memory of 364	2892	msedge.exe	95
PID 2892 wrote to memory of 3748	2892	msedge.exe	96
PID 2892 wrote to memory of 4108	2892	msedge.exe	97
PID 2892 wrote to memory of 3748	2892	msedge.exe	96
PID 2892 wrote to memory of 3748	2892	msedge.exe	96
PID 2892 wrote to memory of 4108	2892	msedge.exe	97
PID 2892 wrote to memory of 4108	2892	msedge.exe	97
PID 2892 wrote to memory of 5828	2892	msedge.exe	99
PID 2892 wrote to memory of 1596	2892	msedge.exe	100
PID 2892 wrote to memory of 5828	2892	msedge.exe	99
PID 2892 wrote to memory of 1596	2892	msedge.exe	100
PID 2892 wrote to memory of 3120	2892	msedge.exe	102
PID 2892 wrote to memory of 3756	2892	msedge.exe	106
PID 2892 wrote to memory of 5212	2892	msedge.exe	107
PID 2892 wrote to memory of 5156	2892	msedge.exe	108
PID 2892 wrote to memory of 4832	2892	msedge.exe	109
PID 2892 wrote to memory of 4832	2892	msedge.exe	109
PID 2892 wrote to memory of 4604	2892	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\never-have-i-ever.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b8,0x7ff806d1c188,0x7ff806d1c194,0x7ff806d1c1a0
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,6219164623013011175,4329495655345850848,262144 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,6388104006848401740,14605218342020016428,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,276013401439751523,13950566433411348886,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,152919131009100023,2217516231766798465,2097152 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,17846978872740930249,3282509543129320656,2097152 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,9330463145877343225,186438860078297124,2097152 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,3803558548322337504,1972337711968702029,2097152 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,9827999056100053343,3517531829486163799,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,1119170096169578861,2491249573705561528,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8311685677291065568,13222816127616860166,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8311685677291065568,13222816127616860166,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,2094634999107419111,15977896742330115506,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,3528197883006015895,11974758942964096387,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10533519334887099492,16879785276607786681,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,16570305674514171550,2414851555930480438,524288 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6428,i,10127420576953429415,18351393388785114488,262144 --field-trial-handle=2124,i,13532539715741408609,4220004490879233973,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a4d0fc70d86d301de2d351fc68a8f55ed7762748a3423aa0caa9d6de71f12f88
MD5 bec224e237fe86330ffbf82cc07589af
SHA1 a6d950a5648d64b63d9a4d0674bec18167e10bf4
SHA512 b86999e1c5b85f35ea1229deef9f21cfde4ad11f885c0e7fd70fd110409e34c120e7f77800d67f1f22c7dbf93e385164e8ae5f2a93f061eeb04fad5537077248
TLSH
T1A33161708F3426FFDBAF45B657D24A9C3371885B37072E1023646D744A49377201001D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5ca36aa8f66bcd5908149924a3e8805306a35908a03f8bab8b808897604331b4
MD5 827d771160657762a5f0cd58824b60d6
SHA1 7c81ae0bd972ba2cb394a81506f9724bd7070be2
SHA512 dbd787bdd1ef792a4dc2a7db7375f3478d9e6b7a527344eeb4eca867ff0672f727bf712435c9cb27deea7659c9d5cc98469cc785db443317efb6440663ba9bb3
TLSH
T13B41CCF3C7E4956E890146F0AB186F2BCE2D0915832C3D6AC9E4AE2B97F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b3e07098f7184c0e7bca4bb5d062968aa41b2bea3fca1d3158cc7befc958d33a
MD5 445501b6d0588aafed94743c293e6bf3
SHA1 edb83da3703306758811853804d57c2dc28e1df7
SHA512 9145ad8729ad163e74f9e6c6f3e2126ca3734f01325783713064f4363cc84cf68b86decdd7817d0bc6c742591538d7bef4a24149d6b5b263ae4dadd6e0c13552
SSDEEP 192:sxRjRqbG/f8+sqW5wGHzoA8p4r/g6+WNIYoXWYZGWBIgIJ:sxRjaG/fHsqW5puC/5ImCts
TLSH
T10832B7156928A97B8CC7E21DBB65BF53D6F9103361D42E58B6FC960C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2af70b2afa122d55be9d19331906e123c7e0855a058c089ffdf1d081f6b5b900
MD5 6e1d38e6a6dbba8bceded773cd0a8ed6
SHA1 4b7b2d930c3f56edc12e6a9ec62eb1cf76f2a3fb
SHA512 bcaeb33a74bc012306f5c6456c9f0632f9821224aed8df21c9d64045428d73613773a2d80803470ddba7f2d31666934f247afe25321ffa96e7674cbbbf78dd2b
SSDEEP 192:sxRERqbG/f8+s2WpwGHzoA8p4r/g6+WNIYoXWYZGWBIgDiJ:sxREaG/fHs2WppuC/5ImCtK
TLSH
T18042B7156928A97B8CC7E21DBB65BF53E3F9503361D42E58A6FC961C00E76DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 932654b58893d262edc4c620ab6816448cf992e4e57959a362b3da9d64c4665a
MD5 35106e34831ad17e4954aa2050b571f2
SHA1 8445b266323c415e5a6b6e63e6a5639cee439370
SHA512 987bce6f2b88107a3c9e5111da646f153ffff4ec977c56722098c56a3358e62bb646afe865d8fa21d11bdad53dcc7c166150d6302999e3faad75cd4f5a566147
SSDEEP 192:sxRERqbG/f8+s2W5wGHzoA8p4r/g6+WNIYoXWYZGWBIgDAJ:sxREaG/fHs2W5puC/5ImCtA
TLSH
T14032B7156928A97B4CCBE21DBB65BF53D3F91032A1D42E58A6FC961C04EB6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cabc1636b6264344901ca54b655d9ba0c86332ad4ce3835f1e0ebbbd5315abad
MD5 1b679cf319e2b163ca86095768e60ef9
SHA1 c8602ee5128c1b4ca0a2f9081285def8ec7516c3
SHA512 11b413f3a8c97bc1650ee1259f1876e05e8743092641c7fc74f755d2a4e02d60a80dd542ddef1615bdc889c6fb1872fdc51be8817cbff63ba2fda3ab651afe44
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXiro98/:j26H0RWgs2f028F1+UoAYDCx9Tuqh0V1
TLSH
T182B2DC2B640DCBBE5F800A9DDC19AFDB6D9802C79B588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 23fa57648d2972d5065baadb247185fe221052e0b7aa79b8ea983a67aca10342
MD5 a05586a8f1e521358f2f1a27adeb7bf4
SHA1 89713acec2ec8464ef63ae90063934995e128a84
SHA512 a581f2118d2a95d6682c5717861398fa54721adf131febce5944166297a24dab9f51c31f4aece585783cd26b03361b058f95726aa4fbcf3bb2f3717b74009ac1
SSDEEP 96:KRENE8EzEnE9EXErE/WEzEoEWgEvE/K4EugERE/cEVEtEgEDEbEUHEuEDESEOEon:CENE8EzEnE9EXErE+EzEoEHEvEFEugEg
TLSH
T1F0A10850B03B4381393DB60CD8B88D5E82D27896345DA5AB3B580665CF6FE539EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c9f6ecf957089f7d9bb10e073401c780cc7367097749031d335eccad61702e9a
MD5 aef0555518370e0bcc12e3bf3b88aabb
SHA1 df4e7c87ffea8f57c309166a496bd48686855e57
SHA512 d2f5e2b4f26e9a85a9a2b981dd4a093237c450a5ea2029aaa72c14fd097ce781d884adea8ed18222995ae729e3b4fed6ff25b7dc7a8407e35b37d4f32c214600
SSDEEP 768:8rv+4UNbdt3Ujg/TBOWZAG3ONXyer1IRCzni9RU:8bsbT3U0hSIqnWU
TLSH
T17A03BF31E4A8AE334DE2A2D6B10776437FB81157C9C507A0EDDA2F4D069B5AE230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 42f14fce524c4d087bd1ac9c9fbafdbd584a051e14fede88286e9078a4f05942
MD5 9e996319c1b5b42fb15e1e7f16ba295d
SHA1 7e697cd3762a3abaaca9c4c4e5bc43a2fe5cefb2
SHA512 b0415cd588bd96962d4eaf7a3c4144557e848c2d9a9e2315e0af4fd1ed1f9aa7774e9a1f2854cb9a001fbfbdfa770c2e40cbc89a4f1c383973dd549d9378be6f
SSDEEP 768:tFQc3/wgEg/TBOWZAG8ONXyer1IRCzni9RojKgqmUghOGFR:8c3NOSIqnWfgRUg8Gz
TLSH
T14203AE32D495DE378DE6A7D1F6463313AFF54063D9C0AAA0EADD6E0E028759E130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a671a6453a5773105dac9ef543bcd895d376f29584010e9851588d2b11e4c557
MD5 3657af38f4da11c555379c5789eff831
SHA1 72d44e2df55952c94c59d31ef2fa01e3ce81ddb2
SHA512 8d56e098b4f4ca13c288cb09d4b6a49e7ad67afbb3faed22fe3f1d9c8f8ceefe63cad6339d585ba5540395e721d7acd86693e584683ccd8f8b1755d6578115bd
SSDEEP 768:eW3kg/TBOWZAG3ONXyer1IRCzni9RojKgqmUghOGFR:eW3nhSIqnWfgRUg8Gz
TLSH
T16AF2BF30D4659E238CE2F3D6B24677536FF95123D6C45BA0AAED6F0E028795E130F42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3eb7f3a286769109eac50919ded0de9504ffe90f9ed03a51d67718d6e144ab11
MD5 9e659d2e88167aeec81a7e448a420a6a
SHA1 549e20250add54f52d1199a65d61eecfffbfa411
SHA512 9d34474189e4f3fe97ea2d021c34d5c3ee8c3bdc8501a506bedef389856386172c60676f212413aff618e76d8813899440e474526f4cef0b043d641bba648918
SSDEEP 768:YW3rg/TBOWZAG3ONXyer1IRCzni9RojKgqmUghOGFR:YW3MhSIqnWfgRUg8Gz
TLSH
T111F2BF31D4659E238CE2E3D5B24677436FF95023D6C05BA0AAED6F0E028795E130F41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8212567d752de18d7dd10d81a49330be89f9a0959f794fc8d249af669033ef4f
MD5 4c94c5c4e70400cf717d3b94b523a2a2
SHA1 1ba661c40ecc037045a724e9ef44a50e33a48fd5
SHA512 9033c928a1c16a33460b68174cc0b2f8984dd60726fe1e876fdfb3e9aeccb3a55851ca0fb1b235d9157b2c590bec006f15760e4f299bd5057c6554c3e1975308
SSDEEP 768:hrv+4UNbdz3F8/TBOWZAPONXyer1IRCzniBxeVH1SK7:hbsbV3GCSIqnuEH1l
TLSH
T16203BF32E4A89E334DE2A3D6B14773437FB85057C6840B90EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18efc41a-c7d2-44cb-b292-fcc781c62c9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\18efc41a-c7d2-44cb-b292-fcc781c62c9d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download