66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m0-eL.svg
Size 3KB
Sample260803-ml5lsagb35
SHA256 66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73
MD5 95b7e2e1d8065db4ac2ce8927e95981e
SHA1 9f303ce03119c2588fcbb4f320794622c61045e5
SHA512 88d142db6604e75c03e021e409b771a60808f39568002c877a1bb39f1dcb57f89da8c819bd1a76d8cb929edd7c1405165884108a2abca02f298c6a497219887b
TLSH
T1E871268876F87EEBD7C802570D51D4B84B2F946BD822978DD3CB90E875282AC735D5B0
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5224	msedge.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_885492259\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_885492259\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_1055629676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_1055629676\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_929731626\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_929731626\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_602140733\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5224_602140733\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4080	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302271582931492"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{E1164152-7014-4C33-9277-436FEC5432E8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5224	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 5224	2348	iexplore.exe	90
PID 5224 wrote to memory of 3404	5224	msedge.exe	91
PID 5224 wrote to memory of 4080	5224	msedge.exe	92
PID 5224 wrote to memory of 4136	5224	msedge.exe	93
PID 5224 wrote to memory of 4136	5224	msedge.exe	93
PID 5224 wrote to memory of 4136	5224	msedge.exe	93
PID 5224 wrote to memory of 6096	5224	msedge.exe	94
PID 5224 wrote to memory of 6096	5224	msedge.exe	94
PID 5224 wrote to memory of 6976	5224	msedge.exe	96
PID 5224 wrote to memory of 6976	5224	msedge.exe	96
PID 5224 wrote to memory of 6976	5224	msedge.exe	96
PID 5224 wrote to memory of 1428	5224	msedge.exe	97
PID 5224 wrote to memory of 1428	5224	msedge.exe	97
PID 5224 wrote to memory of 1428	5224	msedge.exe	97
PID 5224 wrote to memory of 4388	5224	msedge.exe	98
PID 5224 wrote to memory of 4388	5224	msedge.exe	98
PID 5224 wrote to memory of 4584	5224	msedge.exe	99
PID 5224 wrote to memory of 4584	5224	msedge.exe	99
PID 5224 wrote to memory of 4836	5224	msedge.exe	101
PID 5224 wrote to memory of 5352	5224	msedge.exe	105
PID 5224 wrote to memory of 708	5224	msedge.exe	106
PID 5224 wrote to memory of 1856	5224	msedge.exe	107
PID 5224 wrote to memory of 7004	5224	msedge.exe	108
PID 5224 wrote to memory of 7004	5224	msedge.exe	108
PID 5224 wrote to memory of 5432	5224	msedge.exe	111
PID 5224 wrote to memory of 5432	5224	msedge.exe	111
PID 5224 wrote to memory of 6080	5224	msedge.exe	112
PID 5224 wrote to memory of 6080	5224	msedge.exe	112
PID 5224 wrote to memory of 4432	5224	msedge.exe	113
PID 5224 wrote to memory of 4432	5224	msedge.exe	113
PID 5224 wrote to memory of 2044	5224	msedge.exe	114
PID 5224 wrote to memory of 2648	5224	msedge.exe	115
PID 5224 wrote to memory of 2648	5224	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m0-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m0-eL.svg"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x318,0x7ff8b120c188,0x7ff8b120c194,0x7ff8b120c1a0
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,6673846019590594434,13930783264136364518,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16673712797932461115,11822109408238343178,262144 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,16165426637775276637,15095768244552884379,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,14577867271460846006,721487394903480151,2097152 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:6976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,17419660566718126433,9011871162243861565,2097152 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,1000409497519879039,8596291176314782224,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,3379179885481634654,11542399789794071819,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,8506523750761449857,10189795904908654710,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,8506523750761449857,10189795904908654710,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,7226363602074890837,3871559589140129754,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,7521725330555723400,5386970793034497038,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,14671464537367112210,6397755987111842580,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1156,i,15278660336955061229,4061836172502240485,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    PID:7004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,276689405333457296,13641539737744830355,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=824,i,9312956431903876256,13979900608330728587,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,7824472781072215519,11907030892587837361,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5628,i,17290432094475764535,16862518951929305463,262144 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,11418677311106129432,2727487167074380299,524288 --field-trial-handle=2668,i,9873596516069974246,1867021069321421008,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e85308d8cbd725991d3f886cd8db308e0016465e98169e76912815d1d7cb32e4
MD5 e8b85b1a4066f5d3f950017e64c43e44
SHA1 e6f6109e78bceb907404ad309a87f5be27f09f3f
SHA512 2e9d1b3029a7fc7a607537fbe34b7bc0bc1a0c281e805f92a72fa49dbd6ad5db695835f67e60b8c74f8a93643e4a25b21c480add439ba1ad580451c668c51738
TLSH
T1C6F028A6C821BC371DFC1B1860A94B47EB90132B3B41989B7B3D925C4FB163B8686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eea5543799991db91e9361bcbe88239ba1c20e948e0285c8ee392b0cdb30ba39
MD5 84d5b31dd4b5cd33318b3dc6859dbf0d
SHA1 b921d56bcbafe7ca6c0cbe6dada6daf1df3ece2e
SHA512 81b7711cfbe9cecc751e61c6073993c8e23bfcdfb979f3c8895075930e8dd9b2aba75a2bbedcc4125ad794869c4df5bd20907e12e186692371db33842c2baeef
TLSH
T19B51BFF383E4856DC91196F0AB187E2BCE2D0914832C7D9AC9E0AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e129a960114ae9ac41a343763368046503f13edca0ee68d8642eb291bf80e69c
MD5 80c4eb54552d7892fce03b3ea33e9bda
SHA1 affadcc8256b6e15e85bcc9200f2bab0a244d078
SHA512 9daed9fe3584a2e6cffa17a2536c7ff07d6c333bbdec3141511195e7f2f01be334d57e6e2124d7eeacb04cd0ff5c0eb5496ba6c3b65db715b65cf8d430694151
SSDEEP 384:sxRDHqB4/fus3rhpN/RI3ls/5IW4nsGQOLB9:sfKB4/fprhrWq/5IW4nsGQi9
TLSH
T1F472FA15AA689D778CDBD219FA957F93D3F8513391905E44AAFCCA0C04E67EC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f39b250b909935ba0758acc703eb8f35e385a7a627b0a6ca69495ac7efdc0165
MD5 dd7541ba6ea0463d90582968f9b7ffef
SHA1 813984f74284c435d791288e47e7b367495c3868
SHA512 d38a544a41a14435b3ee6f09cfe4fc63124e456de6b24a122d21c6427e2fd7ce2a612e3ea53c53833cc22d56737e4672ec8d9ca95e541dba8d9879cd1521a4e4
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpobbDwzrom49:Ob4YZnE7yTWg1NfwBu1jayobHwAB9
TLSH
T1ECE2EC3B280CCB7E4F804ADDEC29BDDA6DA801CF56D8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3b189d2626dd0ad032d73e320c7057fad600cd440f7ed6f709a28e228b991715
MD5 0c1fa601016c22f8c2342183c7fa240f
SHA1 688a21421ae15bb0a85b4e65ea357cce836eebfe
SHA512 68f390f19ee66f7cd591046715e104a197a33b70be7b7b01494d4506e02a35dbab0c0dd31eaf94e9b4767ad176820f99a067e7229683f9195899a640f5d4fa68
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9JVr:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRe
TLSH
T122B25B11713F4290387EA90C91B9D82F96C2B4637519E53F7BA801A65F67E038DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb6f5736-95b2-444e-acb6-942b05886482.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb6f5736-95b2-444e-acb6-942b05886482.tmp
Size 15KB
SHA256 35073d91b19fdc11bc0b4e0fc88aa5e5b34c404b197726907caca2c482407e04
MD5 309197eb4a5b4fd2b6c8452dd5fe1564
SHA1 1f23cc49f873bad68ab520bc1619e51f44cd27df
SHA512 13fd4ea8795d86915d24c4c722f0c3b60dbe97f23d0e5d8ca83ca19c9e029ea79ebab3e9ba87165c63c351a58119179c48ed692dfa33451fa692f946b0c09b13
SSDEEP 192:sxRDRayMqZjK1Ml8wC4/fusBhd/wNRZRI3BzoD8peT/g6+WNIYcC4CEsGQyGg6kN:sxRDH84/fusnmN/RI3ls/5IW4/sGQOj5
TLSH
T1FA72E915AA689D7B8CDBD209FA557F53D3F85133A1905E44AAFCDA0C04E67EC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d1b3976e54b7af91833dcc278799146b49f91ab17ae96ee1f4335544b12e6ed7
MD5 bd6198dd92ffc3e812f25d1fb6b917dd
SHA1 05fa3cb8cc17ff85849139840c383589475b74b9
SHA512 e917902fa607b715aaeaa861ff15061b2eb210ea8b23662543c54397a2a1d93a863285fdd8a7e34f8d3e178c0238cd0b5eb4ea4b874dfc61922bd7a4c8d6ca40
SSDEEP 384:n6iFiZcIzD8NL68TUNTUlIR3PvuTGfUmeff+GGnR9nnFLc676HlytEDq178LEEIE:xFQfQ6wgluUUrGRd7oy6Dqc
TLSH
T121D26C31D8E4CA77ECEB8AD5B64A7646DEE0116389DC9ED8E5D99E1C00C72DE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1fd9f87d52e9776c90766cf3e2456eb72c23d8d3a1206cdd8ca66125adf80ee5
MD5 172dde269a418e74fdcdb74a25c55c68
SHA1 7f8ab31f69c655602fce52f4d7fe01a690521f68
SHA512 249d23b22054db76025b663bb75969dadf8e9a2a93c22f7f982917582607e4a64df6bc192fa04b90a6f24609dd0d7f34bd2c8bb17093aa64e534a007b9cccfc1
SSDEEP 384:neiFiZcIqD8NL68TUNTUlIR3PvuTGfUmeff+GGnR9nnFLqq76HlytEDq178LEEIE:1FQiQ6wgluUUrGRT7oy6Dqc
TLSH
T164D26B31D8E4CA77ECEB8AC5F64A7646DEE0116389DC9ED4E5D99E0C00872DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 64d723f9c2d57b1f116317a6158dbedd6a4589d3a3f5d7e8f71b8ce5ae2d69e0
MD5 97f4289dc50f571b05d95712056d266b
SHA1 737c6b91be0416027f7a9bd0845be09f13442c2b
SHA512 e2bb1f298edc181005933a56f7cfd8f7c73f0c0c627587b3be1d6cecd7bc723828127e89e96aa9b29dab079dafbf998489f72f4b8ad6f11ff80eaa23a4d7d3bd
SSDEEP 384:n4iF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTukReff+GGnR9nn/LgOObjI9G6w7uW8O:DF1j+9SXOwgUuZmGRRg29Mj
TLSH
T1A8C24A32DC95DEB7EDE74FD8B24A7A4AEEE01267859C69C4DAD85D0D00C72ED0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b409fbef1ff59cd76ca5593d0839d974e46547486e0ffd424dac6baaa3c4fde4
MD5 bc446dae3b09cb53937e62500a20333b
SHA1 33f79ea6adb51f01a9911aca229684ee1b104145
SHA512 0d0132972b30cb31347e8be163a0c0215c892a3ab1f1095b2b36a314278f62507f9852d1fd84ed621133ebd1c9bafd7fff5b2cd899ab0bf95cd5588acba6f09a
SSDEEP 384:nYiFiZcIqD8NL68TUNTUlIR3PvuTmmfUmeff+GGnR9nnFLqq76HlytEDq178LEEn:jFQiQ6wglupUrGRT7oy6Dqc
TLSH
T106D26B32D8A4CE77ECEB4AD5B64A7646DEE0116389DC9ED4E5D99E0C00C72DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1cb077cc77dafe396ab6371da0b84d17a5670c5a1f67258c8d0ce9b16055d5aa
MD5 cbb394f2fb2f60b96de506c8e9fd9d1f
SHA1 da3b18f3ff978ea9c5e8c0bef888c3bc07ff8d32
SHA512 8df33eb4ac25ed0c377a018ad4158bd21c098a98142e2e26803a0af03772807381e78861d3b32e4f621d458edf18582f4523d4398aa94dc953f63993d9dbe001
TLSH
T1524140E08C3919C2D4FD0DAF748B39FC84D88726F5A4303868A8EA58967D25E364483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 000d8c398a2486f6ac06a63cb1fe623622cc9c6e6ca9d34cf872f86d10d847c2
MD5 e148e96f4b9ec436a8fc26349eb3b685
SHA1 b22f84bee0c43c2fa847fe67b5398bef3a88b0cb
SHA512 4cbc25231b3d2686e8ab3fb888a5fdd9978054ef5317d881381bacd6700097185798949bcf499076f4ceef4ba7d1ce85df3c240f0c097f2299c1e9a746b1aa85
TLSH
T1A2411EE09C3919C1D4FD0DAF788B29FC94D88726F494307828A8E958967E65E268483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3df19836dbbdc5b1421ad8dc4f7e7e0e7a434d2617ad0282a47668f0071d5437
MD5 a3dcf738dc6e5ac7d9cf4e7251687726
SHA1 0fa66734ea4a1723e40fe030e1148e966da66236
SHA512 fb4e007caa73a0809c1153241a6cdc386c73ede299c669d8ebfb6b9e20367ab6c0a58a7a3d213c3c9260d7accb85def6356c041eac1f7d599b79602d986b1e9a
TLSH
T1984164E09C391AC1D4FE0DAFB44B29FC94D8D326F4D434382858E968963D65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download