0aad0c1f0c4d517f4d75f8dc6346723dbbe1d8c1376001aaed3cda0e9b9c7173

Analysis

max time kernel
148s
max time network
163s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload/Roblox.app/Frameworks/Persona2.framework/optionHomeIcon.svg
Size 634B
Sample260705-d7w24ahs3v
SHA256 0aad0c1f0c4d517f4d75f8dc6346723dbbe1d8c1376001aaed3cda0e9b9c7173
MD5 64a389b27718b55f0f03c16951e41866
SHA1 2386970d8904d9e236f11eb4752e36b8aeb140fd
SHA512 880626c3aa07e57bd5086d13145cf2ac3d114b754104db00fb0ed63f79ee561a7d9caf6274869867a77eb0139a5bfe6af711fb7fdf52fd538666ad4889f14e69
TLSH
T1EEF07DE9238A982DF0155661F701733550BE33272D491050CE691C3559159DDBE3B8C4
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3940_480784294\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3940_480784294\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276965734616127"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{40B7A088-4BA4-4CAF-8352-D5DB989907D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3940	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 3940	5784	iexplore.exe	89
PID 3940 wrote to memory of 5736	3940	msedge.exe	90
PID 3940 wrote to memory of 6424	3940	msedge.exe	91
PID 3940 wrote to memory of 1552	3940	msedge.exe	93
PID 3940 wrote to memory of 6424	3940	msedge.exe	91
PID 3940 wrote to memory of 6424	3940	msedge.exe	91
PID 3940 wrote to memory of 4556	3940	msedge.exe	94
PID 3940 wrote to memory of 4556	3940	msedge.exe	94
PID 3940 wrote to memory of 5620	3940	msedge.exe	95
PID 3940 wrote to memory of 5620	3940	msedge.exe	95
PID 3940 wrote to memory of 5624	3940	msedge.exe	96
PID 3940 wrote to memory of 5620	3940	msedge.exe	95
PID 3940 wrote to memory of 5624	3940	msedge.exe	96
PID 3940 wrote to memory of 5624	3940	msedge.exe	96
PID 3940 wrote to memory of 6684	3940	msedge.exe	97
PID 3940 wrote to memory of 2556	3940	msedge.exe	98
PID 3940 wrote to memory of 6684	3940	msedge.exe	97
PID 3940 wrote to memory of 2556	3940	msedge.exe	98
PID 3940 wrote to memory of 4224	3940	msedge.exe	100
PID 3940 wrote to memory of 5684	3940	msedge.exe	104
PID 3940 wrote to memory of 3588	3940	msedge.exe	105
PID 3940 wrote to memory of 3184	3940	msedge.exe	106
PID 3940 wrote to memory of 2516	3940	msedge.exe	107
PID 3940 wrote to memory of 2516	3940	msedge.exe	107
PID 3940 wrote to memory of 3952	3940	msedge.exe	109
PID 3940 wrote to memory of 5220	3940	msedge.exe	110
PID 3940 wrote to memory of 5220	3940	msedge.exe	110

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Payload\Roblox.app\Frameworks\Persona2.framework\optionHomeIcon.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/Payload/Roblox.app/Frameworks/Persona2.framework/optionHomeIcon.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7fff43d3c188,0x7fff43d3c194,0x7fff43d3c1a0
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,4911021024592963244,6350641231819543761,262144 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:6424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,18016092893394916013,10394444571064634457,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,5625462118312334484,5772491759472539826,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2620,i,14367709772205728992,546672726785203186,2097152 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,17503942507897010118,10998636381366963785,2097152 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1209751844393816872,12597791793214537877,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11771547169918334175,971765884125550619,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,2715725737422988584,6856198976263828548,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,2715725737422988584,6856198976263828548,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,13339931126205768661,8028504945533188560,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,3466845486460786411,13144004489764540196,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,5791484380304850730,4714436061513618803,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,13719672370111008068,11319126543236210838,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6564,i,3991989478058130447,16941416905050951240,262144 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2539675038520552363,5353988217062637630,524288 --field-trial-handle=2244,i,1827448967760036667,12938875118676632918,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a3b6bc9-a7ad-47a5-acc7-dcc8156aec67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a3b6bc9-a7ad-47a5-acc7-dcc8156aec67.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 39152de1f0f37fe83a16adb9d4d135e6d4343a94104020e22e635e6f8215cc52
MD5 b14d2e23e8cf0b57d041e97950a03cef
SHA1 3a30536d3d43363bdedd720b5a2289c0a75f4d5a
SHA512 7f2e0da5e0dcc4542c027b24b415ee5fd7cd1f240f1cd7f605381525ad3ebbda3563adac3f1c468028397d83c1b417dc765711d0d43e9c00d833852ce54f9e17
TLSH
T13751BDF7C3E8866DCA1195F0BA186E2BCE2D0915432C3D5AC9E0AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f482c6d833e23720d0b9ce80c59b4067ebc939d150c0a93b0245c51471fb50dd
MD5 717b21797844dfb140ec73ad1afbc44f
SHA1 5e6da3c252da4563d28911ee2c5db1ac55755bf2
SHA512 6e4a697b7aff6d5d7fbdcb57eddee0c2cb2831eb5d33441cf27c7e216206b9393dd982a165c9cc13929e553a6ff128b9035d63ab6da83cbc7948236f4e6a6926
SSDEEP 384:sxRAcCa/fksXYxBaSRiMaIO/5ImosXISjs:s0Na/fwxEDfx/5ImosXIX
TLSH
T1F772E9056938997B8CCBD219FA957FA3D6F91573A2905E44AAFC8B0C01E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2cd013bb4445e5d7ecb8474e96fefefd6b2e43741e0cef765a525844f3f58c91
MD5 9538420236494f99466926174e6af9b8
SHA1 d84a036c5ae50cb60d631276e5d3f636a3ac6ee4
SHA512 48b3a196d00cc7c1fb34e640538c16d5d0d3e842298dc31087a2f996b2ee87717953dcafb309e29d41d5b0f9dd0bf6443ebfbf0d36648df0572b04a72bbaddfc
SSDEEP 384:sxRAcqxa/fkspxBaSRiMaIO/5IisXISS1:s0rxa/fxxEDfx/5IisXIb
TLSH
T1DC72E8066938997B8CDBD219FA817FA3D6F91573A1905E44AAFC8B0C11E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0d16720190286f1f2876bd33a8bb425d6deaff6a71276ea24085bf54a3c9d479
MD5 9ad1c47f697ebf0fe96244eec4f07a3f
SHA1 9d0fdeb46354bd5b61c22ef5344944760da029cf
SHA512 fdd6501718933f79795b5ab3de7809e0ea9820cb158266b8810dd2c52f04aa5198354f7da9c0220801604261cf2d6bb413ab1e44872905d41b03292c35b1bb18
SSDEEP 768:PRbg3u7pLuL75sWgtVfwp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWokUfYHroJRzBr:PRbg3uE75sWgtVfwpu1jatokoYUJRF
TLSH
T1D0E2FD7B680CCB7F4F804E9CEC2ABE9A6DD802CB56D8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e3d0c2d65733e6654c69835710871f7a6028693dc31229722bb8404c29efb8f0
MD5 7c9ab7719953e7e001b39e81cfa3063b
SHA1 79d0e461b7d51ba815b0d87e563dcb6996a52b1e
SHA512 78265c15470e9e335c18d5007aa133c15769a2c29444d92157aca48678805a0008b6b2ae74ba84d96600ce048384f3f801c021268e7142110e945572c2267752
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/X:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBF
TLSH
T132B27B5171BA2B00383D240EA3B9841F5A4630A230DEA97B7B6931E56F67F004FFD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ce51edfadba17676f86cbcf3e4abc08212ec26cb1c2273064e96b22dd2b1d841
MD5 8114cb4e4fffa498bace3d4faa0273da
SHA1 c3c14fd2bb7312d88ab321d2e4f27c3d431e5609
SHA512 295350173d9a1d317fdb7f8a32b7098271c6102e122d2ea01d7e97217af0dc2777e7373d9f3e28f353e4e094c9b97c902366a62cec675c63d9c7b558956155c0
SSDEEP 384:nviF1tNn/s3n9Sv8Nh8TUNTUlIRo0zvvoPOfoFGB4Po34TeM/LapUmn15wbAjEJs:6F1j+9SEwgv8GWDTj/LyUmn12bfJKv
TLSH
T12AC23936E8A4CE7BECE68FC9B7497656EEE4126385D819D4DAD84D4C00D32DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a01e9ab38e074315b5034015f8b4bf6af9a9bdcdb676f5aed41bf55c93bd8592
MD5 a32907a3cf1993d8f9c65f792896f752
SHA1 51c6a7884d96df4391e48b257c8f1d432071b8a5
SHA512 6b80a125a29978f925d4b730a23bcedbfe118f2b693a5718004f3bcdb3ac92396e761de88afe7a04bdccb3652226b888f8c0fc9fe99c872ef6e0427374fa4d02
SSDEEP 384:nYiF1tNn/s3n9SH8Nf8TUNTUlIR20zet+POfoFGB4Po34TeM/LaHXxVOObjI9G6h:jF1j+9G+wgmGGWDTj/LYxV29Ms
TLSH
T187D26B36E895CEB7DCE64BD9B75A3656EEE0126389885EC4EAD85D0C01C71DD030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5fdb4f359ab0fd0f46254ede7031c4e51b0bf2a74c717c7365b3f967feea45bf
MD5 098c1b26424cacec29312a0d2525ec0f
SHA1 e1046b181dab566cdcb75039dc4b3704d44aa33e
SHA512 0c97f2d3d4e4e1e0728adf2af20e6f2248a15ee6fe9b3d6f07d200436d468374f1a30b2ebfa9dadd6a33f767d5a3d91475b72f423f3f01160f94efbda6dc8be5
SSDEEP 384:nXiF1tNn/s3n9SH8Nf8TUNTUlIRl0zFt+POfoFGB4Po34TeM/LaHX+Vmn15wbAj0:SF1j+9G+wgmGGWDTj/LY+Vmn12bfJKi
TLSH
T12AC26C36E865CE77ACE78BC9B7493656EEE4126389C85EC4DAD84D4C00D72DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 36a6f27e71ad45e9354bbdaa82432c0eaa0c2fd9f61365dd8d3a132ce7dcdcf9
MD5 63e6f9e23f14f8dc64875a3481e2b48e
SHA1 81702908020a3d6105068667cb1a975f5dcbe357
SHA512 ec59032d3f5d5d25a1d607854992a83f7a01cd6c285ea085afa8ef0738c664ef9ab154acc6e2284f1cb3cfd377855b06745fc0fb6e2e58cbf499f84119a13bae
SSDEEP 384:n5iF1tNn/s3n9SY8Nf8TUNTUlIR20zet+POfoFGB4Po34TeM/LaHX0VOObjI9G6h:QF1j+95+wgmGGWDTj/LY0V29Ms
TLSH
T161D26B36E895CEB7DCE64BD9B75A3656EEE0126389885EC8DAC85E0C01C71DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download