d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v11K-m5-eL.svg
Size 28KB
Sample260802-b3kgdsbd89
SHA256 d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d
MD5 f2f7df101c9bf5d75ce49d42491e9f8c
SHA1 bfa147420c27f8f75982ba6d99be1b938f30cd3c
SHA512 85aa10c95f787a0460395f4aaaa5184eefa4b66ebfd48e0931d021752560f69fee8e79a0788d026d5c00ca8258cc558db5121631ce5c6bd0df1410ceb6c76dba
SSDEEP 384:ckwQGRNPUTQLwwizqwaowD66Uu9dqbvCK+E9xrYTxkk4sQsDI:c5QGvji
TLSH
T125D24D6437F83C9B8BCC03478D52EC68465FA8B7C498678D97C7D4E8A988368F76C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_503969426\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_503969426\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1972887511\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1543296458\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1543296458\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1972887511\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\shopping.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5488	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301085680081365"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{5567C598-88DD-4505-87CA-5E51DC0A9B9E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4252	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 4252	6116	iexplore.exe	90
PID 4252 wrote to memory of 3304	4252	msedge.exe	91
PID 4252 wrote to memory of 3968	4252	msedge.exe	92
PID 4252 wrote to memory of 5488	4252	msedge.exe	93
PID 4252 wrote to memory of 3968	4252	msedge.exe	92
PID 4252 wrote to memory of 3968	4252	msedge.exe	92
PID 4252 wrote to memory of 4716	4252	msedge.exe	94
PID 4252 wrote to memory of 4716	4252	msedge.exe	94
PID 4252 wrote to memory of 3000	4252	msedge.exe	97
PID 4252 wrote to memory of 6964	4252	msedge.exe	96
PID 4252 wrote to memory of 3000	4252	msedge.exe	97
PID 4252 wrote to memory of 3000	4252	msedge.exe	97
PID 4252 wrote to memory of 6964	4252	msedge.exe	96
PID 4252 wrote to memory of 6964	4252	msedge.exe	96
PID 4252 wrote to memory of 6968	4252	msedge.exe	98
PID 4252 wrote to memory of 6968	4252	msedge.exe	98
PID 4252 wrote to memory of 5724	4252	msedge.exe	99
PID 4252 wrote to memory of 5724	4252	msedge.exe	99
PID 4252 wrote to memory of 2744	4252	msedge.exe	101
PID 4252 wrote to memory of 6064	4252	msedge.exe	105
PID 4252 wrote to memory of 2420	4252	msedge.exe	106
PID 4252 wrote to memory of 4532	4252	msedge.exe	107
PID 4252 wrote to memory of 5064	4252	msedge.exe	108
PID 4252 wrote to memory of 5064	4252	msedge.exe	108
PID 4252 wrote to memory of 6204	4252	msedge.exe	111
PID 4252 wrote to memory of 6204	4252	msedge.exe	111
PID 4252 wrote to memory of 1232	4252	msedge.exe	112
PID 4252 wrote to memory of 1232	4252	msedge.exe	112
PID 4252 wrote to memory of 3216	4252	msedge.exe	113
PID 4252 wrote to memory of 3216	4252	msedge.exe	113
PID 4252 wrote to memory of 4516	4252	msedge.exe	114
PID 4252 wrote to memory of 6356	4252	msedge.exe	115
PID 4252 wrote to memory of 6356	4252	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v11K-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v11K-m5-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x398,0x7ffbb43cc188,0x7ffbb43cc194,0x7ffbb43cc1a0
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14515771956173360330,7867371527788197132,262144 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,1116153459184628434,1051167291735989746,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,17631025035798412458,4215597965682925624,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:13
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,10472171080351516842,6898612477816447242,2097152 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,17286064012879769534,1676919700835672276,2097152 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1191193926121055108,8408008452807411750,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,7581317055898418810,8845942627990155295,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,12032713356852602008,11991464974783854909,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,12032713356852602008,11991464974783854909,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9669351425740940997,6776013765123211378,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,7100212987173548408,4785257908302718000,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,15421099868224916286,13458630523377300170,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,10302283411507963534,4827470029736191748,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,7757446375909638299,17329380358238612157,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,13913795457387367557,12473547913660497284,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,8828028804869971773,10124431406354156396,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,16246066851496708566,11110796529264202516,262144 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12636251169537541651,3537543964988968265,524288 --field-trial-handle=2300,i,10917389496768834385,14879306281032608610,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
    3⤵
    PID:6356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bd8771cd263e9a509de7bbc800dad9cad35618a35257371fe5d346261aa2500b
MD5 54478186a9b058ed9e925044c29a2d8e
SHA1 f779dfc9b2fe09ce35e1fbb5a56228698141b194
SHA512 8853092f30c32a651c8f8caa703b38d3b437a6231ee4890640497263d7dca2757b484c755f4248ddfdb4cde3860445276b3ac0f2b33cefaafcf2633265ea1f4b
TLSH
T15AF028A6D821BC3B19FC1B1870A44B47FB54136B3B81986B3B3D921C8FB163B4686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 18ad60799f63f9336bac6db90c142ff22fc3dca91c48857655d131433a7ef099
MD5 66e42784707645a1d458e3127df5be8c
SHA1 589ae5440ccc2a9ca063d771f4a7f014612b08d2
SHA512 a7ac0a170c341f26310d61fa69118c4e6d89fffcba1c859d745a4071f40b8fc3cfdd36f291771842560cdce807a442a9e31b9d10997ada307ce73108709532c4
TLSH
T1E3519EF383E4856DC91195F0AB186E2BCE1D0915432C7D5A89E4AE2BA3E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c16cfdaa-9f52-4fb5-a55f-e3196f3e56d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c16cfdaa-9f52-4fb5-a55f-e3196f3e56d8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7ecd193cc3989340e189ebfbb13779d42e4205699351970a6b3a85957b9319a0
MD5 18d789800198c266a428527336e0b62a
SHA1 38736f7f8ab092fcb0a48d33cdf53c9253209d05
SHA512 516dd814260423e732b763046c5bb4906c314a7c0cbe6cf8a0f2f1d2030e7883ec8a884c0d5c51e703a9dd21eb58356691a217027d4e271a474233d484366bc5
SSDEEP 384:sxROJ86/fHs+KN/RIbgL/5IW4WsGQVGjv:sqG6/fn4Ws/5IW4WsGQVI
TLSH
T1EE72E9156A649D7BCCDBD209FA957F93D2F81173A1505E44AAFCDA0C04E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8409b921d802265791cfe083c6ac2fc3b63dcb0cfad5bdb0046eab40fa80ff42
MD5 f95ad05b4426813582721dbdb0f1f821
SHA1 c3dff91378685f12a40b182c98e7e8a9d31a64a1
SHA512 b828aba95419fa0129123fba6c64e39fe98c42bb7ad447cf752559ab4be474983e1627baeedc575825999d532aa721d6f544d8502eb82c1ab7d021dfc4f92835
SSDEEP 384:sxROJq4e6/fHsl4N/RIbgL/5IW4XsGQVG48:sqQ76/f0iWs/5IW4XsGQV+
TLSH
T15272E915AA649D7BCCDBD619FA957F93D2F8117391501E44AAFCDA0C00E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2d88ad81a5d8e793f00c102fad75ff4aa68a5b047ef3aee72df8099279cdd203
MD5 4061d0fb983db26ff08db8d3c4101ec8
SHA1 58fbe1e27096d5d155c9f443670858a3e3aff385
SHA512 3ca83018397bf029c5d15a95ddbb1d24a16771784ff2a08311754fb25d78b85054fb99714d968c5ea2821cb01b21d6e0fe19da1a98bca59c97243c298aba0a96
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroD4H:Ob4YZnE7yTWg1NfwBu1ja0obHwAEH
TLSH
T126E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4aac7f9a8afd4f6b4289f4a9eb574944e5e4f6c163f258ac967fbe1d88c358cd
MD5 a61377882e8417ea2119d556602eacf6
SHA1 e1cdb9016d9787460cbb130c8743997399770cb5
SHA512 f4f1914022ad250d36d6b5df6ac40d2e71a4f7f2695a7e1d14d469f811c3babfea28ccb6ee02a73d0e8ec314039d2f15ffcb8b1e036e70eeee1e7f6efa74289e
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9sfU:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRC
TLSH
T199B26E11713F4280383EB90C9178986F82C2B4637519E52F7B6846A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 49c802a86b1479932fb0aeeb48d5d81cc79af90ab92c4638e5af36e316148021
MD5 d7c48385a8d1627cf391232d28b38c92
SHA1 764d9ae243be5f8e02177c597fe8a91d8d7df335
SHA512 f216c4bec7c654e4ca28ab6b317b5406575f0fb96cf61d0804ce1f2c3ec66b9ec0e5a1ce93811deed3c9606a8bb033a402a163bc5150ed97383865ce7c1afe92
SSDEEP 384:nIiF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTuwREqfbYGGpeKLVOObjI9G6w738LEEy:TF1j+9SXmwgUuxUGGrV29MJ
TLSH
T198C25B32EC59CAB7EDEB4F99B74A7A46EEE01167849C59C8DAD85D0C00C71ED0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9a5d33b7c2775b62eac576532385eed53a77eaeab8bdfd4ec86a69322d46bebe
MD5 e27b321d31fb1b0e4284b1244175a00c
SHA1 b826d04ad9f3c2ff04284c6ff4af5c6d3cd71c1b
SHA512 fb4320cdcd3b40b841572f4e5c5cbe614bbae901a3492bb90a1e92410e1281865ecab3925de33154d60c0bc62497509c5b92a342cb26ff85c219cf2d26f52d51
SSDEEP 384:nkiFiZcIQ8NLb8TUNTUlIRtPvuTyQ9EqfbYGGpe+DLGbLnTKwBODNZOCfWQ8LEEQ:/FQQQbwgHudoGGNiLnewBKZOeWM
TLSH
T12FD26C32E868CEB7EDEA4F99B7497647DEE451A3D48C4AD8DAD85E0C00871AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 90cb64540f636562e1224f475af3336a3eb8dda10af149ea7ccb4365903950c0
MD5 fd74d63e39d415b08d75db6f72f500f6
SHA1 c4786bcd002b5b936a61cb8bd2949a67f9ec42ee
SHA512 b583e8ae7f5a06733037842978274ce48daf4162dfa9dcf749dbc66c7cd380d63845d424293379da1f2244827dae03e6068198d6c42d6cf2716c8fbe3bb3e4c9
SSDEEP 384:nDiFiZcIQ8NLb8TUNTUlIRtPvuTyQ9EqfbYGGpe+DLGbLnTKwBODNZOCfWQ8LEEQ:uFQQQbwgHudoGGNiLnewBKZOeWM
TLSH
T1D9D26C32EC68CEB7EDEA4F99B7497647DEE451A3D48C4AD8DAD85E0C00871AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e57d4131ee356eac239a7070331b81286722fed475dde881fccd370642165d2e
MD5 0aa71a573b96fb61567cdbfb4795fc57
SHA1 e7032637f202ffad9866b13c53c07230f55f7f6c
SHA512 8981c15c4d263e6f41392d89f5d8b4aac0c185bc16521ffb7749aadbab54a3eda5095afa7d8d67453d976a7934ba47879549f4983ffea97853a56502dd3a96d9
SSDEEP 384:nDiF1tNn/s3n9S28NLb8TUNTUlIRsr5PvuTlQ9EqfbYGGpe+DLGkLOObjI9G6w7g:uF1j+9zQbwgyNuuoGGNvL29Mg
TLSH
T10BD24C32E855CEB7EDEB4F99B74A7A46DEE011A7848C5AD8DAD85D0C00C71ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 09955a4be7466976de847fa4a66e567ed4576f5307f79fa5f7e444f240c0fa1d
MD5 308f624ffa3dc36058f49cc20286d9bc
SHA1 470815f51f046a5f435272b709a50852e77129ae
SHA512 da7af783596f6d93ebc96fcde03e03d93a1fdaf1ec773f784d2814f7dcefdd0f217d7c2586a0dd00d506a1d0ed97cf5d1fe6483e3b3e9f54acca2eb0901f5d3b
SSDEEP 384:n+iFiZcIH8NLb8TUNTUlIRtPvuTyQ9EqfbYGGpe+DLU/LnTKwBODNZOCfWQ8LEEQ:VFQHQbwgHudoGGNoLnewBKZOeWM
TLSH
T131D26C32EC68DEB7EDEA4F99B7497647DEE411A3D48C4AD8DAD85E0C00871AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 63f557abf3f15c211ed60cb4185a8429b4a44b2e292a0f6c7d89230e20b29120
MD5 bf4de7d70543e89db388fb8c4a30f92a
SHA1 b69ef090d659cd376591bf6b54d9912855addc66
SHA512 5d50f9118c4f0593d0d718ceb0820988671cc7d016831caf39673e32a0e9a93a08ca1f794e4a6ab4221a23580bf817da674058e516d27b23f25156a2c19453f7
TLSH
T1AC5142E04C381AC1D5BD0A6E748B38FCC1ECC726F490343D6869EA48597A25D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bc40160699a9c493f07f187ac9ff324c35efd61713d54877437bd5cc9a198319
MD5 c9644b5249f4a9183c9af4abf954c9a2
SHA1 291a87e5f88be5ebe7f1403e88e4a0fc8b0ab588
SHA512 a0d8c53b0067107207eabe13b5f304dfaea45ea53510cd879911d254f5b117d6d28818825ce4dbd55ab44e3aeca54ad05ed58525b40c38abb66704c500a59a48
TLSH
T1F1512EE04C381AC1D5BD0E6FB48B79FC81E88726F49034796868EA58597A25D218483F
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4252_1681425690\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download