8e4878f9c1bcc3cc4b8932c7d1501ce066fffe91ec3a55883ca2ba90e05d89fe

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
images/delete.svg
Size 1KB
Sample260701-g47afahz21
SHA256 8e4878f9c1bcc3cc4b8932c7d1501ce066fffe91ec3a55883ca2ba90e05d89fe
MD5 810c702b83d4074c9ecaf9780a099d08
SHA1 ba27d83fcf808500b4ff38bdcaa51990caeb7816
SHA512 8c3f89fdff3d54d35b757531d3015ba5986cbaa00a3b43d25a475795af1eea4cdb8653077f128b4d33853aaea507208f06b6a3c888b1add15ad598d7ed00e238
TLSH
T15A41AB45F1A244DA922C82657CE6A509C21960538588497A79DC1C60FFC54D2B37B3DF
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3900	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_84042447\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_1641511902\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_1641511902\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_1510301849\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_84042447\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_1641511902\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_1641511902\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3900_1510301849\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6692	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273605717630208"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2581000985-3042091657-4068028891-1000\{8BC23798-AA7C-427A-822A-E509FD500F75}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3900	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3900	3036	iexplore.exe	91
PID 3900 wrote to memory of 6084	3900	msedge.exe	92
PID 3900 wrote to memory of 3544	3900	msedge.exe	94
PID 3900 wrote to memory of 6692	3900	msedge.exe	95
PID 3900 wrote to memory of 3544	3900	msedge.exe	94
PID 3900 wrote to memory of 3544	3900	msedge.exe	94
PID 3900 wrote to memory of 6016	3900	msedge.exe	96
PID 3900 wrote to memory of 6016	3900	msedge.exe	96
PID 3900 wrote to memory of 2692	3900	msedge.exe	97
PID 3900 wrote to memory of 2692	3900	msedge.exe	97
PID 3900 wrote to memory of 2692	3900	msedge.exe	97
PID 3900 wrote to memory of 6560	3900	msedge.exe	98
PID 3900 wrote to memory of 6560	3900	msedge.exe	98
PID 3900 wrote to memory of 6560	3900	msedge.exe	98
PID 3900 wrote to memory of 1348	3900	msedge.exe	99
PID 3900 wrote to memory of 1348	3900	msedge.exe	99
PID 3900 wrote to memory of 7024	3900	msedge.exe	100
PID 3900 wrote to memory of 7024	3900	msedge.exe	100
PID 3900 wrote to memory of 4796	3900	msedge.exe	102
PID 3900 wrote to memory of 296	3900	msedge.exe	106
PID 3900 wrote to memory of 6248	3900	msedge.exe	107
PID 3900 wrote to memory of 248	3900	msedge.exe	108
PID 3900 wrote to memory of 6768	3900	msedge.exe	109
PID 3900 wrote to memory of 6768	3900	msedge.exe	109
PID 3900 wrote to memory of 6744	3900	msedge.exe	112
PID 3900 wrote to memory of 6744	3900	msedge.exe	112
PID 3900 wrote to memory of 2768	3900	msedge.exe	113
PID 3900 wrote to memory of 2768	3900	msedge.exe	113
PID 3900 wrote to memory of 5764	3900	msedge.exe	114
PID 3900 wrote to memory of 908	3900	msedge.exe	115
PID 3900 wrote to memory of 908	3900	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\images\delete.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/images/delete.svg"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffb86e7c188,0x7ffb86e7c194,0x7ffb86e7c1a0
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,10860382838258745972,12321809865277930031,262144 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,18287327903962440869,11508394394647429577,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,475138630453635684,7357615364937007647,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,16670668646780104602,10105222471669315311,2097152 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,1894361544510126429,7077998685505319228,2097152 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14673915680593459894,3667073373317831793,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6423189794764221887,10448673975453447652,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,17257776606943470512,7693425490199042221,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,17257776606943470512,7693425490199042221,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,308711012819189069,16034896387411468550,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,6831808087089848168,9191840406174680057,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6763839504793342375,6593569685430930770,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,415896986614254846,2259264810392659693,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17955851724143647813,3552071330378622549,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,13853896629779699723,547147319338151335,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,13829722314757649665,5521517751062894887,262144 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,7092141939634483066,15974973044384457769,524288 --field-trial-handle=2240,i,16289083933575402162,10781801620081175686,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a068243c4584907cd5534c5544cd99e57be64a6790401ecb34e138b941be50d8
MD5 487201c9d5f8581b404c328a57b95064
SHA1 9118509fc3137d34e8bd3939f3883afe9e9beffe
SHA512 6e13ca057d8cd084911b83c51e96582deab6bc970f1d4d15642021e2d461c0a71257fc4e9734447735b2fbe584808ce6833fbe556372a5954dea7135d7b571e7
TLSH
T1E8D080747F18B841C5D53571553B8700BE964116355FC645F052D10C4C398E5FBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55097ae3e8e09b80bce3e3812987755ecca81384247ee729ac4262e176ac5f09
MD5 c1487ee49f8ccdda3c17fbfc8fc5855d
SHA1 22e1d68df0a4913cac107ff5af4cb564d869972f
SHA512 cdb748df700c498fc821f44fbc432a65b818ee7361fa8899d196bb2c32c7c86bd90573282a6465e8a2d722cbc27ecdf3b960978409d4ad6fc7fe8483e801e91f
TLSH
T1FFD0C0703F08B841C5D4313045378700BE924116340FC200F052C10C4C398E4BBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 298dbfd720b4c23219184ee34c22486818d53dc1cb117db25400c864c8cddcb6
MD5 7972c23af2eeeeb9f7a4aeb624c7087d
SHA1 f5f4330c0c62758acc19c539c5880471cc9e56e7
SHA512 5908210aac901fef9eff627fa7b5b46b45b9a613aeed72265a21f77e6f607324b37fabf98b92bcf04cdc5d42a687cf4bcbba9ff6fd21ca754a9b5d5b5c4fce05
TLSH
T122E022BAD821EC6B18F90B5961A4024AEB5613172A40496BBA3C810D8FF163A128A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d25cb4f37d4b7d202ae4ba422646227b7783c084f587f15ff007c3dec2daa8fb
MD5 f26a95f8472f81c3b961fa773d6d3f30
SHA1 3a166ac1be5a6179cc4ec67257d28d1e8cb10c0a
SHA512 f77b5bdeae295bb63f8a8a8a809f414ae355cfb6fd2d280bde2559148dfb876912c2b019d1f3855f00acacace230fa9250ea311c0029dd3dc07d5fcd7cf965a1
TLSH
T1AF41ADF783E4866D8D1156F0AA18AE1FCE1C0515832C3D5AC9E4AF5B93E3471E142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 41eb3d5f5a1fcd5d12e843ae2d6bb1b1dbc6067bb9fda409ccbe9be820bc20d5
MD5 ace6a63d8ea3dce31ed7543bd88e79fe
SHA1 db681590c9b3adffa98de3d48b21361adac70e0a
SHA512 940101baae9f88e8decb2e29c80801a86bcca8de35b877182ce736a43a4d99227f17047079c9ac89a72c8199b676222bccbcb480669aea2d7dfc5d9fe583ed7b
SSDEEP 192:sxRVsqsmRIfyMqZjK1Ml8UQYgcYs5/fwsQsYps+27Z5Oh+2NxrsPzoA8peVsh/gF:sxRLbqEn/fWskC15OhvNFp/5ILvTXS4
TLSH
T15E72EA156A74993B8CDBD219FA86BF93D6F81533A1804E44AAFCCB0C15D7ADC211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 965de8287d2e9510569880512752680005c5365d4379db85e659011b9652ad17
MD5 cb547ce8c971fc4b205569a00c204edf
SHA1 44add9d8379f57b494381b18a986802ba11973e4
SHA512 632c5fb356e03da28abeb6b1daee7146a714e053d0ba5dc499c266a4020666753138ec74034b6ae7346b8095a3eb67d6a7a7d781df6284ec3ac6ddf70ce20d99
SSDEEP 192:sxRVsqsmRIfyMqZjK1Ml8wcYs5/fwsQsns77Z5Oh+2NxrsPzoA8peVsh/g6+WNIb:sxRLbCn/fWsnC15OhvNFp/5IyvTXju
TLSH
T17062FA156674593B8CDBD219FA86BF93D6FC1533A1805E44AAFC8B0C11D7ADC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e22510681bf5e2ee9128c9d47edb5cf9a2edf0af927ab0c98bc72261ac417cb8
MD5 f624a6852de6135fcf3c4aba57eb460a
SHA1 7495ad27f1986a2e35722c846af9fc1fd7c5c2d8
SHA512 d90026aa9b12a6ca6a17d429f6e0841c4a39e3062a2ad5e5c9781da00b9b02b7848e7dfd0f26fd8f5c63f921aa766a4bed1e161863737d0100e581f71706cfc2
SSDEEP 768:57pWlr7pLuL7S3WgTXf0F8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2AVdRtAroYAHF:57pWl9E7S3WgTXf0Fu1jaZAVntLYAl
TLSH
T14FE2EC7B684CCB7F4F804E9CEC297D9E6DE802CF96D8895447EA840C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ff0a02bfbc0f9ac739d0a72881190e099ceb7830a0cd8b31dbd621d888262dde
MD5 5748183dbab68d7e729a2459561d681e
SHA1 1b94554b909ac6cd80d35978b66e6be5fcc8505b
SHA512 89645a681c123e418149a09b6d381929d3f1e649bf16083201b0aa905959f38bab47124765278019a468333a87b631ffad83cfb60626b618f5498c0671c54dff
SSDEEP 384:97SnL5NRMtAPjvR3R8LLAZrK610IK4cZ0/IAie3+7S6nkM94Z9Lr76TmtNFn3v2x:ShJtf3BlQ1KbhJv38rv
TLSH
T174B25E5130BB2B00387D250A93B8842E564630A230DEB97B77A975E26F67F104FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b8f9dd48f700a33f21e48e87fff8ffa59323f3fc9d28174fd906f48086d193c3
MD5 324264c2afd2cd012bb8257567ff4d54
SHA1 f09d21ed9863f040de681902c55fb389db56b882
SHA512 a225c126543ee43886f1b75c59931b4e17f4416d710c5fefa7671cfdfe42c65ca9f6f9a65a75ba542cdd77d5bc345f318786066043e6a036bbabb826e71bfa86
SSDEEP 768:zF1j+9Scwg2bRlTrWuGNso/VNPeJmn12bfJu:i9S3Mso/bS0yJu
TLSH
T1B4C24A36D894CEA7ADE78F89B70A775BEEE40263C5C81AD4D9D81D4C00D329D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d13449e4feb914a9f67e5c0d3e9ed2ed9c6b272523f7bee7e2f77764c8abbcd8
MD5 fcf55a9d0ba2b21e50259ef257f4351d
SHA1 18de8b35cefc85383c010e1f06129fd5ad16e8c9
SHA512 b02ded993725e7b3f788076c2e7520f8c020874fa3d630b6d93af6a9d7aefb3cefe71875317cce818fa32eb373db677417bec6453c69baf959c070d239d8a10b
SSDEEP 768:gF1j+9P7wgkbRl2UFWuGNso/VNPFdNxlD:t9PU21so/bLlD
TLSH
T10CB23B36D895CE67ECE78BC9B74A7687EEE4116385C85ED4DAD85D0C00C729E030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f0faebcbb8ab3f696231a94110dcd65d5c62884670ccb74e438b4f1c7c5729bc
MD5 6df198ccb4183749a006548124499b3c
SHA1 8c9e9ed69936583b78cc04ed7261913d75a2f7f9
SHA512 6bfb6b56c98678fa7de208f02fc285183775c2dcdcdacd34aff3f0c7b6a0b4aa4f73f03f34c38becc150540dabfd7ccf24572333259eb2712933a2a6120e3c28
SSDEEP 768:/uF1j+9vr7wgabRlEUFWuGNso/VNPFdMx78KztJt:/L9vrWE1so/b47tztJt
TLSH
T1D0C25A36DC95CEA7ACE68AC9B74A7757EEE41263C6885ED4D9D81D0C00C729E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b3368f64ac6f5e940e1b7b688c9708592aa2920757b5c2cb84e58bb13ba3c690
MD5 bd0196898e9cd08b8479c12e3a847612
SHA1 e2b1b37a258f4d36857935e8424a09b576fcc7d5
SHA512 0830bac846e607f94c91245f29210075b566f459719fef8efef3baa99cd1a024a4e20591b4fb10fcce4b02f7002b283a012bc4de7c19f289caa96c3e6a0c0584
TLSH
T14A3140E088383ED1D4BE096F308B24FC94D8CB26F554347D6858E988467A65D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ec8c4b09ce6de17fb078db345fbea35a30b1a3c0cb334cd750428329db6f0e3a
MD5 20f64edfaa47076a575a1b6e048e68c3
SHA1 e472542ea8b290c541f3cbda26f455869c3c0655
SHA512 d4dad4d3f3ad988cf0e2ba4fa33a441ec9feb629d682fc6da099e50539937b88f24e7577277757ba5c401d34954dd5406a834400a99002e36b411604b98deb99
TLSH
T1A3312EE088393ED2D4BE0CAF708B24FCA8D8C726F594347D6864E999813D55D6A8083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a6a1679f1d7ab5912d7e146e69ada84e42f8f57d9953bc54e16756dc6aebed8b
MD5 41c9b843388e53b6f9beafa6cd309f14
SHA1 b08a4f99a92d4a07c1712b4b8226875f25ca4097
SHA512 fdd06a63a7075b4dd16a1b191be242c769373bc7bf667cbbbd49b89e9c9ff24b8feb8024d7710d53aea3abc63bd37ea96280f61052cafb5707f538197b961656
TLSH
T14F312FE0983D3ED2D4BE0CAF609B24FCA8D8C726F55834796854E998513D19E268083F
MD5 SHA1 SHA512 TLSH

Submit Download