2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v15O-m1-eL.svg
Size 44KB
Sample260728-e2kbsaar2x
SHA256 2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1
MD5 2afb4097fb2218401ce6072aa93f8307
SHA1 faf6a9c1effa6293ec2021eac520dce00486f4e0
SHA512 f66dca04fa73cbae407bab6bcc97525d8d397ef065a220094ce93dcf717293611e9f00d05915fc2d4c5bd63b27ce5714f07b8b27c62cc32ab4efccf5b81dd84b
SSDEEP 384:c827NHdmDcvlxO4fnH5AomEkJW9mOx790u+wycg9+fiUCFRlg0vlg90rf2:c/NHMWaA90C
TLSH
T1CF1340B537F43C9B8BCC034B6D42FC6C46BF94B78458668C9BD790E89548368B7AC5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1840286098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1589841705\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1720993142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1720993142\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1840286098\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1589841705\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\shopping_fre.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4504	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296863786274810"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{7EBBEA1C-6236-429A-AA16-A3E61E48BE0C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4624	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4624	1984	iexplore.exe	90
PID 4624 wrote to memory of 5392	4624	msedge.exe	91
PID 4624 wrote to memory of 4440	4624	msedge.exe	93
PID 4624 wrote to memory of 4504	4624	msedge.exe	94
PID 4624 wrote to memory of 4440	4624	msedge.exe	93
PID 4624 wrote to memory of 4440	4624	msedge.exe	93
PID 4624 wrote to memory of 6224	4624	msedge.exe	95
PID 4624 wrote to memory of 6224	4624	msedge.exe	95
PID 4624 wrote to memory of 3848	4624	msedge.exe	96
PID 4624 wrote to memory of 3848	4624	msedge.exe	96
PID 4624 wrote to memory of 3848	4624	msedge.exe	96
PID 4624 wrote to memory of 3304	4624	msedge.exe	97
PID 4624 wrote to memory of 3304	4624	msedge.exe	97
PID 4624 wrote to memory of 3304	4624	msedge.exe	97
PID 4624 wrote to memory of 5592	4624	msedge.exe	98
PID 4624 wrote to memory of 1268	4624	msedge.exe	99
PID 4624 wrote to memory of 5592	4624	msedge.exe	98
PID 4624 wrote to memory of 1268	4624	msedge.exe	99
PID 4624 wrote to memory of 476	4624	msedge.exe	101
PID 4624 wrote to memory of 5028	4624	msedge.exe	105
PID 4624 wrote to memory of 6020	4624	msedge.exe	106
PID 4624 wrote to memory of 5644	4624	msedge.exe	107
PID 4624 wrote to memory of 2676	4624	msedge.exe	108
PID 4624 wrote to memory of 2676	4624	msedge.exe	108
PID 4624 wrote to memory of 5408	4624	msedge.exe	111
PID 4624 wrote to memory of 5408	4624	msedge.exe	111
PID 4624 wrote to memory of 3200	4624	msedge.exe	112
PID 4624 wrote to memory of 3200	4624	msedge.exe	112
PID 4624 wrote to memory of 624	4624	msedge.exe	113
PID 4624 wrote to memory of 624	4624	msedge.exe	113
PID 4624 wrote to memory of 2724	4624	msedge.exe	114
PID 4624 wrote to memory of 5376	4624	msedge.exe	115
PID 4624 wrote to memory of 5376	4624	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v15O-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v15O-m1-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffb26e1c188,0x7ffb26e1c194,0x7ffb26e1c1a0
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,5450924712223069053,8854973520340518077,262144 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,9724903971498176454,1201124319171798775,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,17150822347558398004,7541249478484493884,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,12377749019195419019,3449215117672748167,2097152 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2380407550022808358,3590420050926630334,2097152 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,622123353084750891,4503343102272916776,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,733949765481892657,17206741560556230411,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,16247166400247378694,17628127298418910668,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,16247166400247378694,17628127298418910668,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,3618031928450571743,8901827172852914327,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:14
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,12963476140191939486,14652744519700097937,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,13296472625686558331,17474943016977770205,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,8126511176627688195,5525601387337437253,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6815801081245935161,9807833173214717536,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12487660989040435488,448841827893406057,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,12056407696600390125,4158835021372462877,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5628,i,4091371140119313529,9586271448103939785,262144 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,5937429443722143750,8820898597144822018,524288 --field-trial-handle=2764,i,1338610240546612869,16370841402883905143,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 851daaf98baff27c2a9f0a80505e58cb576d297fcba57d971d5a7557cfb81f44
MD5 748094df3bcdcbecc3baf24ea9b2d60a
SHA1 358b9f803e43ee5ce02377a7624715ac8957e5e0
SHA512 318510aed37fe72dbd57585ae9a470195ec95699a815ffb1b684664e9e2a91ae5442380a1cb090b29998780091e6a11cdc21eae5f0a75c9be50d1119d5909af8
TLSH
T19DF0A9A6D921AC3719FC1B1D70644A47EB50135B3B51995F3B3C921D8FB463B468681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 881177dc4add3bc9100976744e87b9a97e7e685ecb8e01095c4ae1be3085c5b4
MD5 3df6cfcbd38842e2ef177dcd4bb299f6
SHA1 98112cf78b4420978580dd0569863638320397e4
SHA512 021f1715ec81f0709c8a94b664056d1101ea3887c5d9d74c966dfdf14295f5bac5fe86c6195f8ed2d1da94425a9012788b7689bb03c57fa1d75e5d3083f2c096
TLSH
T1FD51BFF783E8856DCA1195F0EB187E2BCE1C0914432C3D9AC9E0AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9ef3ba902f31a0d291e96854c61528139cfff98a558389f8adee85672db3f833
MD5 436b02627e27a7fc513cc0065213a2f5
SHA1 cd558c6621b20806540ef9115585edcf395ae860
SHA512 7887e0b4a3f84617a3fc55aa2d241b8a321d709ee53dc66d74a0f8b28abf70ef36949e94e4fcb709e80f8bf5f43ca1eb64fa6ed4cb0109e9447007a05a8b4892
SSDEEP 384:sxRUy8s/fhs/tN/RIwg0/5IW4xsGQ996djd:soPs/f0vW0/5IW4xsGQ99O
TLSH
T15972E8156A249D7B8CDBD209FA957F93D6F91173A1905E44AAFCCB0C04E67ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0060446d591cc147f8690c20c8c3295514282d7d2aceed28d3c6d4d0b4bc6ebb
MD5 dc71cfbdf188fdd531a8e009343280ca
SHA1 38e2b20a3158ea7efff8651f587f7fd219d2f317
SHA512 426f5a1d56a64dbbb2e53092e22311e8b095d7c6fc2174b3fc9d4d4a98d13c9c2a912f191bcc349074f90438bddf563bd0a29a82e25ea533f8f85ca03322a7d9
SSDEEP 384:sxRUyqns/fhsxtN/RIwg0/5IW4tsGQ996dEa:sodns/f2vW0/5IW4tsGQ99M
TLSH
T12F72F919AA249D779CDBD209FA957F93D6F91133A1505E44AAFCCB0C04E67ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f3a68e8731d46dde3dec5456eed6e2317d97a93655f789b6e8347a2d47892401
MD5 d872637c7e45acc5f78ca6ec472fdd91
SHA1 660afaefa852f95a1041ce727e57ac74dd5ce296
SHA512 ac515af3f0913416b215d03e378293e069b88ce6e2b7ecd0cf5d5c4a79739374ad8cf6a5c0d5714a9cd1c655f6ab51a84cf3f4defe6323c537bc14c3c3b00d0d
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAobbDwzroa4Z:Ob4YZnE7yTWg1NfwBu1jaTobHwAlZ
TLSH
T1A3E2EB3B280CCB7E4F804ADDEC29BD9B6DA8018F9AD8895447EA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8822eb1dbe92603d522c1d24f99c017815465edc59d1b5514ffaf02182394a55
MD5 ae17eca824bc31a0641e9fedf43c4826
SHA1 ca5169134bf38e50828be4832d45b59f2cc0127b
SHA512 baadae05bf959a98d605035edf4e2ae2c850d8a9c7c3c778f3a0344fa50c0da40c5009da2a1de58efb43958810abd9baf215b4c870efd2bb859e6af5de3b9c0f
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9d5E:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRV
TLSH
T134B24C11713F4680387EA90C91B8981F86C2B4A37559E53F7BA801B65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4178be417b63b99969c8b3c326e734e8aa467461cc703ac921aaea71ba30340d
MD5 58f6b860eedd9ab287f38c31e2ec3846
SHA1 10823009cc130bdf948ebff1f9329233683ee6e6
SHA512 b2fc8eb52006dd6167c6e4fbd082d86d256af4a4c4f4cddc181f7da6fab9777d0e12887cbbaee66c93383827ae96868e24a4c2f186a4e193368b931b04f15437
SSDEEP 384:ntiFiZcId8NL98TUNTUlIRGqPvuTr8nEqfbGGNcA831yHZEyTkOObjI9G6w7i8LA:kFQdQ9wgsyukgGaA8lwk29My
TLSH
T119D25C32EC65CEB7ECEA8F95B6497656DEE06163C5DC4AC8E6D88E0C00972ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 18cc02ea4b018ba7a87cefe255bcf4f41f7b24f6238d9a91e842fbae6848cef4
MD5 42f25f84f613b2cbc49b69ac0809b95d
SHA1 a33796bb7de11bf26c3ae14c9cc544897b42eefd
SHA512 3dc9b084edeac67c587984a8ddd733425a2a66c316da212ddf53f2f666082ef7e500651cb50d95ce21040fb9c42f939ff5bbbbed5265c0e54b475cd40480c6db
SSDEEP 384:ngiF1tNn/s3n9Sn8Ngg8TUNTUlIRiPvuTuFREqfbGGNcA831yTLkOObjI9G6w7p4:7F1j+9SXgwgUuEqGaA8lYk29M2
TLSH
T15EC24B36EC59CDBBEDE64F99B34A7A46DEE0126385EC59C4EAD95E0C00872ED0703C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3ba265fd7211bb99a991abeff730ef320eb65920b2ccb1fe546e60b2641959e2
MD5 5718f70f48ba08c06a02df1a06b9a102
SHA1 7de6b6d02ad2a7413dadd153fd762198c901390e
SHA512 30d9a02e5c263c0a8acd942ac9c7e273790f81969467d9c5cefeb2915dc427f8eadff120d7542419e5acb481ac63d1758bec99331a327fa6b5e8acb5a78b389e
SSDEEP 384:nMiFiZcIW8NL98TUNTUlIRGqPvuTr8nEqfbGGNcA831yHZZ3kOObjI9G6w7i8LE5:3FQWQ9wgsyukgGaA8lmk29My
TLSH
T1C0D25C32EC65CEB7ECEA8F95B6493656DEE05163C5DC4AC8E6D88E0C00972ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 caaee87196cba3c0acd08a2421afd6300d7ba120cee170c1f99ee27217d9b1b4
MD5 12e5fa92f9b843d6f962caa806f45d20
SHA1 988657129fdfc788ba7e27a996c894a099fad9a4
SHA512 591b7b0030ebff76d4e79ecc8ee6606c52d8933b188768d8639ddf50d93060cea4a75aac07f98766812e26a1bd1a68d2e998d5c273d54acd07006529941dbf4f
SSDEEP 384:nNiFiZcIW8NL98TUNTUlIRGqPvuTH8nEqfbGGNcA831yHZZ3kOObjI9G6w7i8LE5:EFQWQ9wgsyuggGaA8lmk29My
TLSH
T154D25C32EC65CEB7ECEA8F95B6493656DEE05163C5DC5AC8E6D88E0C00972EE0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 03ea54a6253540f28628bc31e07f47047d1828e396885ebb940a702c8ac210d0
MD5 1e8e13a0fed2f2c5366f2cee15d44954
SHA1 a3a4c166512a93417bf21538f3b718338cd41b6b
SHA512 06b3e1cd39b2d4acfc29e9226f74f9878fe023b79724348537527aabfde606fb47e4a6956db027573f0245d0e5f6108f162b925b7d1aabc4b13cb8dcd9843d59
TLSH
T18F412EE04C381AC1D4BD0E7EB48B38FC81E8C725F59034792858E99859BA65E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 35f36c6f88b965c623dbb1317e0c7a94a0302090a69afb879445eae38ab05b59
MD5 99464035502bef15d96cc306c00da9fa
SHA1 d41439754baf6b0a3d4345ac3742b32b2072ecc1
SHA512 d12188b0c1e02ddb09e8c865314ec31fa7957a9047e6c29be53ca3e8208668bbe1b2995bcc07a8da0be122808b67c9d0580b7110701c4cef419c9ae9f33e1fba
TLSH
T1694130E04C381AD1D4BD0A7F748B38FCD1E8C726F590343D6858EA985ABA25D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3d788a59a605ed17c95f085f708aadbdf3662050312a9957d1725de4ed769a31
MD5 7c787dcd8d1442a60633e89535fb1d95
SHA1 afb2516a430e532e24662779c7d22da32506bfa8
SHA512 1937b5f8c0a84b4f4cb597c25ce4e54a783c7a1497deddfee07130a9a99c71a5f5c0b3d9add69c95b1dedfc6058aba8f036a3649042a9b80b4e6a62bca913577
TLSH
T155412DE04C381AC1D4BD0E7FB44B39FC84E8D726F890347D6858EA985A7A65D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4624_1822204230\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download