09a1145a6620c24ca73c44e23c31f7917816ed9ffcb17a8295cbcd67d88745b5

Analysis

max time kernel
148s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m3-eL.svg
Size 3KB
Sample260731-c2f81ssapd
SHA256 09a1145a6620c24ca73c44e23c31f7917816ed9ffcb17a8295cbcd67d88745b5
MD5 8a97a3e2ea7103a874e7c9a32e7ed545
SHA1 b450e9e2801ae7e10cb96224461aeddb11dc1ef7
SHA512 7303da25aa0029a146545b8d2046e553d7c07cc7ad7a6942065592fa27b645f0a9a88448251d474773f712b5eafff6d8b4ec09bfbd1a490865583802a57df4b7
TLSH
T12A61168876F87EEBC7D802530D51D8B84B2F946BD822978DD3CB94E875282AC735E570
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2952_1834937604\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2952_1834937604\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2952_975003038\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2952_975003038\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2524	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299388619069139"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{93B3F618-6FBC-4AB0-B414-705163C43A34}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5452	msedge.exe
5452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 6868 wrote to memory of 2952	6868	iexplore.exe	91
PID 2952 wrote to memory of 1904	2952	msedge.exe	92
PID 2952 wrote to memory of 2524	2952	msedge.exe	93
PID 2952 wrote to memory of 2872	2952	msedge.exe	96
PID 2952 wrote to memory of 2872	2952	msedge.exe	96
PID 2952 wrote to memory of 5664	2952	msedge.exe	95
PID 2952 wrote to memory of 5664	2952	msedge.exe	95
PID 2952 wrote to memory of 5664	2952	msedge.exe	95
PID 2952 wrote to memory of 5936	2952	msedge.exe	97
PID 2952 wrote to memory of 5936	2952	msedge.exe	97
PID 2952 wrote to memory of 5936	2952	msedge.exe	97
PID 2952 wrote to memory of 2900	2952	msedge.exe	98
PID 2952 wrote to memory of 2900	2952	msedge.exe	98
PID 2952 wrote to memory of 2900	2952	msedge.exe	98
PID 2952 wrote to memory of 1272	2952	msedge.exe	100
PID 2952 wrote to memory of 6612	2952	msedge.exe	99
PID 2952 wrote to memory of 1272	2952	msedge.exe	100
PID 2952 wrote to memory of 6612	2952	msedge.exe	99
PID 2952 wrote to memory of 2940	2952	msedge.exe	102
PID 2952 wrote to memory of 6012	2952	msedge.exe	106
PID 2952 wrote to memory of 7072	2952	msedge.exe	107
PID 2952 wrote to memory of 6544	2952	msedge.exe	108
PID 2952 wrote to memory of 4552	2952	msedge.exe	109
PID 2952 wrote to memory of 4552	2952	msedge.exe	109
PID 2952 wrote to memory of 3968	2952	msedge.exe	112
PID 2952 wrote to memory of 3968	2952	msedge.exe	112
PID 2952 wrote to memory of 5452	2952	msedge.exe	113
PID 2952 wrote to memory of 2696	2952	msedge.exe	114
PID 2952 wrote to memory of 2696	2952	msedge.exe	114

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:6868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m3-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffbbb94c188,0x7ffbbb94c194,0x7ffbbb94c1a0
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,2455851929948946441,12799925626824050934,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,11202167434577893634,4703866117641819795,262144 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,10161718092359376776,2076429030860855108,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,7021720011451846387,15156191412529752691,2097152 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,12745497979046290214,4565344728308336466,2097152 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,13613908267284275582,393325800516500294,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16332961881462081661,6602473180373717006,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,5614881185666920233,15091034882994219062,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,5614881185666920233,15091034882994219062,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,1371377919925091626,11694093457591283743,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5306448585174528419,6313988269441790694,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,6172438207063379140,5142521623607917470,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,6768855021791642119,16083551881069484943,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,8964972287529814415,9284714550207084828,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,6385289107128849562,13127675108187489405,262144 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,10281017440964385957,3468059171369743095,524288 --field-trial-handle=2312,i,7643399876139875139,10291573221636947677,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 de1e7d075a9d379426d0605cd20e24b6f0d8c965cf22c5c16dc6ef70c223bc95
MD5 3789a8fb59054aa5e6cf7c7ce1991d7d
SHA1 dffe9147eff89c534eaff18250546d22df61f1c1
SHA512 396beef492f14d1e35943414ae580a1e8d18de4cf05c1ce4c3d4b12d10ca638ed66e7f7e06e7b73facad3de43e02f08ca5fe86cb4030c539360d20066b39afaa
TLSH
T161F0F9A6C821BC371DFC1B1960540A4BEB50131B3B41985B3B3D921D4FB463B4646D1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0305e1ad6abba5f4e6da9ad50ac4536864c970e80a63f734d7d4f0aa7e837e3f
MD5 3cded1119d43303301ed599b3fde0466
SHA1 ed8cd802829ef4d22b6668b75aaa14a16481242c
SHA512 515f600134ca2fb1235ac598dda7c68ce2e66b91cd9c0595d355eb473348a330d505edfc81ae04ef9f85a475181eda7cf615165d4b162c07019a883cfef5bd65
TLSH
T1D551BFF783E4856DC90195F0AA187E2BCE1C0914432C7D5AC9E4EE1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4d1bc8b0a24319972dfce5b80c6dfbb67823d5a68ad4f775406d591aa9da4ac2
MD5 0c559cff60f2db60b393a4aa554a5c6e
SHA1 9217d3e2be9bfacd1fa964a41244a24419b2cea1
SHA512 811cae72892a88eacede90fc1aa7f580a1d320810462508ddbd413001e873d9192a2a4dad8a44d262083503035f477cf733b7e6acdd17bfd66a39fdd61cf2937
SSDEEP 384:sxRhqqaS/fKs7dN/RIEIt/5IW4QsGQKfy:s1VaS/fZ/WR/5IW4QsGQd
TLSH
T15672D81AAA249D779CDBD619FA957F93D2F91133A1505E44AAFC8A0C00E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5767adafefeba87f4fe4b0fc063f1bf2bbfa85d78775bae6255b72dfe69d5139
MD5 2c9dc9895d89718df098455e68bdd11a
SHA1 e4bfdaa4a7ba2816ab5870da1611faad5a9a6de1
SHA512 b424aaa797bddc636921642e8d03f8dc4f77711a5d2fc979293a03ccf5baed8e1458874f46bcca87bf01598c0fc3d89cf4a2017d573177c05c0a820f56c58ee2
SSDEEP 192:sxRhRNyMqZjK1Ml8wCS/fKs21NRZRIE4zoD8peq/g6+WNIYcC4CXsGQNGtIgjzJ:sxRhq8S/fKs21N/RIEIt/5IW4QsGQKjl
TLSH
T12872E91A6A249D7B8CDBD709FA957F93D6F91133A1505E44AAFC8B0C04E66ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6bfec28e0e230fab781d15e38f5660866c008a08e857c07acff345388b723cb1
MD5 49ab788ff4cf3e3d6a5d3ed95ec0f50a
SHA1 b1786552a2c8677a52e54cc594524a0915af0d7a
SHA512 b9f812fa3dab0cd50d64100ae009d8ee791ce8ee184f9e64ba8a46e3037788af2f83002f9a37d7bdd8f7136e920c60e985e2d62d273b9ee863b775bd9d019895
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOobbDwzro840:Ob4YZnE7yTWg1NfwBu1jatobHwAD0
TLSH
T1CFE2FB3B680CCB7E4F804ADDEC29BD8B6DA801CF5AD8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 20e1b247c7f562955c9770ca1391903b68adebb89ff0f09de482cc7cbd136ffc
MD5 f3a5c0f6d67e60fa8cd340da8103deeb
SHA1 532157a2cb58b637fd353c92460798c19c9f5d6f
SHA512 733234b22d48ee9b90374165091e908761c889b3e109469d071e7a89efc882f05c1bfb4dc2e09f8e703867a5a59b0b292aa3f0892d532383844f844878dd91bc
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9l2n6b3xdZ4d0z/TB75oX3UxQ:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRf
TLSH
T139B24B11713F4680387EB90C91B8981F96C2B4637419F56F7BA801A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f6c0022c5cffecc5e882e5830b9ff807d32f7c4f5aab689c3735dc72f1654a85
MD5 4a26317ec17b7da65917c770469db02e
SHA1 962d81a8f9c5de901315e96bb94e85fcc2add893
SHA512 154f5151941f1c7b5e11cc5356c316a7a2e59b5c2d1eb864b8811a36d9d056055bed2a846681726beb944f2fba2fd7382954e48a3f39af1628463235b97327f6
SSDEEP 384:n9iFiZcIL8NL58TUNTUlIRoPvuTaZIESVfbzGjwTDGGL25rJXOOObjI9G6w7aT8p:0FQLQ5wgOuOYtGCaJv+29Mn
TLSH
T180D26C32EC64CAB3ECEB8F95B2493646EEE05163D59C8AD8E5D98E0C009719D0707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b5cc16238d8a8189d09d9f6670c491102fe437ec8e2bec0bd259e901ec409884
MD5 4bdd1ff8770bccc470558fcf6ff0273c
SHA1 b2d9c15fde275edbb6f7b3829b5452d2a478c17c
SHA512 e073bd7b635d57c3b8d7fbca31c266c5c5a150d56879639d811cc1f0af355f986ba2f5c5bcfa1fd41e8571313ed3bc591355e242dddc3906e830826317fccf57
SSDEEP 384:nJiF1tNn/s3n9Sn8Ng+8TUNTUlIRiPvuTudRESVfbzGjwTDG1LGqOObjI9G6w7KJ:gF1j+9SX+wgUuW1tGCaBGq29MI
TLSH
T1B6C24A36EC55CEB7ECE68F99B34E7A5AEEE01163859C5AC4EAD95D0C00C729D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4c0c462eede1ea094b4789baeb45f2811cb174a852bfaab460ec0f94a2ba2084
MD5 df178169b6a11c6fcf39d580a04442d7
SHA1 3e8d7462d0bc90d6a3ec395dc851830ef1ad4775
SHA512 5ba4c69d79193986453fd96990b837ba944b6dc1c58952f463c80d7cee3c716a5245290763b53fdcac879535db9a2c50b40c53d35bd06f0d7e91f7dd6e592b12
SSDEEP 384:nFiF1tNn/s3n9Sd8NL58TUNTUlIRoPvuTPnZIESVfbzGjwTDGGL25rJXOOObjI9v:MF1j+94Q5wgOuDZYtGCaJv+29MG
TLSH
T1CAD24B36EC55CEA7ECE78F99B34A3A46EEE01163C88C9AD8E5D55E0C00D729D0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e1f1e23c2440272835c0e0b3afe7d86eabd41c0e200e19dfa248c1d17aa88d65
MD5 1f40b08f133eec4d0b3a0c2525f5e5f6
SHA1 ecec81179d1d70347da8a2ed741f6c12b8e7b27a
SHA512 b21fbd3c050b0e1e198d6b1305514d3d4bdeb701624adfadafcc64b60ba84d696a0cf13832bb2708aefa5ab52c3de30256d5db12fd94c17e403d03e0381c1c9a
SSDEEP 384:naiFiZcIr8NL58TUNTUlIRoPvuTaZIESVfbzGjwTDGGL2wrNXOOObjI9G6w7aT8p:RFQrQ5wgOuOYtGCaJG+29Mn
TLSH
T1C0D26B36EC64CAB7ECEB8F95B7493646EEE01163D59C8AD8E5D98E0C009719D0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 833c65464b01127c9051c70d07eb0ff6d5fb35965208b14b09e083b4e849a5eb
MD5 f7c1dc3c67dca9d6e073718210f3f7a4
SHA1 c7a976fe8a26d4254910b684987b96a8f6f8a178
SHA512 6d02a7b3a922ee2a36cabb84a33543c4e40570b331a5b4127b1eab45df6e167a24664df919e1116f3a0e93f718b5a37d0974a9089c1d886d5a52b5cd5153274a
SSDEEP 384:nFiFiZcIL8NL58TUNTUlIRoPvuTaZIESVfbzGjwTDGGL25rJXOOObjI9G6w7aT8p:MFQLQ5wgOuOYtGCaJv+29Mn
TLSH
T1BED26B32ECA4CAB3ECEB8F95B6493646EEE05163D59C8AC8E5D98E0C00971DD0707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f43a18893c2f4e6b5aca2f9e0d57a634213d6c5856986daf9adc3332e1be5824
MD5 222ec624cf2d5f8a26dcc110319853ff
SHA1 2961c9682b1d0a73d13f27d63d8e87941e5bbb2d
SHA512 dfed6420ed3f9126ce626740afaf14b847e7271d3a68228ff00891a3a8e53babfa7c233f49d02a424f69a4af750d28739b7a1c025587d7e1036d332b680ab9cf
TLSH
T160511DE04C381AD1D5FD0E7FB48B79FC85E8C726F49034396868EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download