c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m1-eL.svg
Size 3KB
Sample260815-cdv29sdk81
SHA256 c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31
MD5 2226f49d0e59c46b4a18649eb679ae54
SHA1 c969dfea4218c1fab67060e9393a7fc24cc5547a
SHA512 a155996290a9d678506c7112a083decaa035069718b565052611fd751a1fb9378bb55dbdb09a8fabc2a0f5caa91dfbc2eb1e106fb2f9cba9c2f00608c0720af7
TLSH
T1C771368876F87EDBD7D802570D41D4B84B2F906BD822978DD3CBA0E8792826C735E5B0
MD5 SHA1 SHA512 TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3688_2029809389\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3688_1150841166\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3688_1150841166\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3688_2029809389\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3688_2029809389\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3688_2029809389\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312327035698656"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{ED9ED2CA-F829-42A1-B136-C2B4C5998994}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3688	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 3688	5816	iexplore.exe	90
PID 3688 wrote to memory of 3656	3688	msedge.exe	91
PID 3688 wrote to memory of 4932	3688	msedge.exe	92
PID 3688 wrote to memory of 6760	3688	msedge.exe	93
PID 3688 wrote to memory of 6760	3688	msedge.exe	93
PID 3688 wrote to memory of 6760	3688	msedge.exe	93
PID 3688 wrote to memory of 6400	3688	msedge.exe	94
PID 3688 wrote to memory of 6400	3688	msedge.exe	94
PID 3688 wrote to memory of 2176	3688	msedge.exe	96
PID 3688 wrote to memory of 428	3688	msedge.exe	97
PID 3688 wrote to memory of 2176	3688	msedge.exe	96
PID 3688 wrote to memory of 2176	3688	msedge.exe	96
PID 3688 wrote to memory of 428	3688	msedge.exe	97
PID 3688 wrote to memory of 428	3688	msedge.exe	97
PID 3688 wrote to memory of 6864	3688	msedge.exe	98
PID 3688 wrote to memory of 6864	3688	msedge.exe	98
PID 3688 wrote to memory of 6732	3688	msedge.exe	99
PID 3688 wrote to memory of 6732	3688	msedge.exe	99
PID 3688 wrote to memory of 7020	3688	msedge.exe	101
PID 3688 wrote to memory of 4752	3688	msedge.exe	105
PID 3688 wrote to memory of 2948	3688	msedge.exe	106
PID 3688 wrote to memory of 2584	3688	msedge.exe	107
PID 3688 wrote to memory of 1068	3688	msedge.exe	108
PID 3688 wrote to memory of 1068	3688	msedge.exe	108
PID 3688 wrote to memory of 3168	3688	msedge.exe	111
PID 3688 wrote to memory of 3168	3688	msedge.exe	111
PID 3688 wrote to memory of 2460	3688	msedge.exe	112
PID 3688 wrote to memory of 4100	3688	msedge.exe	113
PID 3688 wrote to memory of 4100	3688	msedge.exe	113

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m1-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x2c8,0x7ff9601ec188,0x7ff9601ec194,0x7ff9601ec1a0
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3917603211943663129,5200950668394887425,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,9652800890100448780,8205247569288206549,262144 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,6761377231409894350,13551792959022621130,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,8492766859525774113,12968777468829975453,2097152 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,15714131677554207046,5956242591107068924,2097152 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,12024812892005207512,13945918475172219408,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,389809175683678970,11840596995045860926,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,844710682412337104,15136896092901081439,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
    3⤵
    PID:6716
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,844710682412337104,15136896092901081439,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,11194195601943830481,9115112312961119105,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,141972118559650561,1321849506210762238,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,11646228068874855741,7178268951211550718,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,16397239665102302217,18425948686528974522,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,11941927233439534851,3199204029945875146,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6004,i,12099415626575446509,14707012172841073947,262144 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,856115035438403930,14761258306447148306,524288 --field-trial-handle=2204,i,8467681855692362770,7583028328108709090,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

859e0641-0223-4445-b0e0-c05d21cd3042.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\859e0641-0223-4445-b0e0-c05d21cd3042.tmp
Size 16KB
SHA256 92d1fc5a83a165bb217d5c928b0cd010de8c1c000e046db8a5a759341bc1e01f
MD5 0e761e0874a9ad3f54f797b86abca601
SHA1 1e71b14a86216307a1fc06ab7d09810853be5003
SHA512 8d3be16e9d8ceaf329bcd657a0156b20cc908bfd5068e32d8f82e91c686b1b871806d4508c884d86378a3b38f312f5dae7cc729f00f5ea78fb2672870eb0349d
SSDEEP 384:sxR8DqQG/fjsYNN/RIayw/5IW4lsGQa3I:sA+QG/f5PWQ/5IW4lsGQX
TLSH
T13D72C715AA64997B8CDBE219BA957F93D3F91173A1505E44AAFC8B0C00E76ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6dbdea3a26c5fc48372bd7ebb9363ccaf6d22142e83d4573b4cb16d7ed2f94a1
MD5 0db0ce80707ec9d51b63d19231f0cd13
SHA1 8f47dbf3b078236a324f716a23d0a8137169fda7
SHA512 97351fd3ab4cf8cefd0c94b622f9c0606e8067e5e96a6e5525d93586fd6859098c5b42b77ea47fcbe8c14946ec741a372996cce95add4711b8db4fecd77fcd79
TLSH
T1BBE02B59C820BC3719FD1B18A0544687E74113AB3B50C94B3F3D912C8FB0A3B4786C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0fff1ef2d038d84d880f7ae9d11caea50854619fd7580658b63f074a2ff8ca48
MD5 72353582710ca39ca178a8b1f647baa6
SHA1 1a1745c7844dcde899797ac34c21521c64cea83f
SHA512 b28d606cf30e21b3f434d925b7b65a60dd100e504df89bf187cc5939edc650f1cc4dbb199817ccf6a4acf2dd658610b51c992fac9ca6b6c15c830bc423e701f7
TLSH
T16741CFF383F4856E9A1195F0EA186F2FCE1D0511432C7D9AC9E0AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 91198ceac44775c369d36cf5977c94c80ba2822692b39cfc78577ca82109307f
MD5 18878562496cff611041bef2ceeecb85
SHA1 ce5732a515a0822a5bc24ae222a8d0453bb90bae
SHA512 f0897ee99d921ed806f0b28f0cf72fa249c1dc53c04fa7c5c51342a782b3003504d9b423898a329d23d527bc2015d7cba7ed64ecf8ddcd8f01f1e29970e14801
SSDEEP 384:sxR8D8G/fjsiyN/RIayw/5IW4LsGQajtD:sAgG/fHwWQ/5IW4LsGQK
TLSH
T18572D815AA749D7B8DDBD209FA957F93D3F91173A1905E44AAFC8B0C00E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4434b1c0e757b46af8ff7b530947c006b89bb8ec19e97eee63669abb6442fb50
MD5 6ff9e3e97e7423e9cef78aaaf8f37818
SHA1 74a9cd65396bd168a47840f0c9a0b4ebd1e47d0f
SHA512 799f80a9b390b3ebe5ab967aff918700ccabbc5fccc65d96f2eb9d74661a85183d173b779457bfe869ba357423cb7ccf802ac8bac75932d96ca22186e9163b2a
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroa4E:Ob4YZnE7yTWg1NfwBu1ja4obHwAlE
TLSH
T12FE2FB3B280CCB7E4F804ADDEC29BD9B6DA801CF5AD8C95447EA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 590aca73413f53441e730e8e4460942975ff6273e3de8484905d2c95f8c79810
MD5 908ffed7fe1a60c2e0eb214f1a18e282
SHA1 92bb4163e85acc7cfbbd0f029d9cf70680f34221
SHA512 3370a058b89ee59266e7e176ad7936b59acc020609d392bac7846f034adecffd6426ab776191b7471eb3c504412d22d59c39622c92a215fc5ddddb5fe3f00e6c
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9/50Q18AusMV:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRz
TLSH
T164B25D51713F4680383EA50C91B8D81E86C2B4A37519F52F7BAC06A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b0e463fb004d767d76db43f96a6543bf98782d53327ca318ac6a3fb98f5bdeb6
MD5 1fae13d346a5207ab93e540abbd58202
SHA1 a73f8f2816eb7c6ece9d72293f76d94bc301bf9c
SHA512 20f1bbcf800fb48e40605b44c9d5779497838b1725190cfdc594c0ea3f4c2da36c1d5e47c95bfb3a237d98fc1d45dcbd73cf27b534fd6f3bcd85c99b5674f993
SSDEEP 768:LF1j+9SXpwgUuitGexe1lXDvNZoeK4FTAV5X5i:K9SX8uce1lXDseFTkpi
TLSH
T1B4C26C31AC55CE7BECE68FD5B34A7A46EEE051A384C99DD4D6D85E4C00C72AD0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 87ba4d777fbbaa140b06312da0cd8738b597b7afd6e0f432cc8d041ee1e2c55e
MD5 5d55da7c1725dab5f87cfc0a5858de23
SHA1 89b38f279c07689b9efe5e36fddf8213b87f5f72
SHA512 61d900d2b742c54521fb021b2190cb1fc476344bf19f9473da916b79b4532c3a3d4d3815b00f8f26217a257478fae273879082fe66b02cf528462156352dab20
SSDEEP 768:UFQHQpwg3uQtGexe1lXDvNZoeT4Oi9P6B:3HQvuWe1lXDs9Or
TLSH
T102D25C31D8A8DEB7ACEB9FC5A7497646EEF011A3D4D85AD4E6D84E0C00C75AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b5cef5a34b27ae865a103de52f5812350d0807e72c1e1bd0188ae947f9ec4944
MD5 09b9bf530562164fdda5e1f055e36a2c
SHA1 6d5eaf213a9c4474af32fa9e6a635c29a3dea920
SHA512 b610f9fca103123d168a2aad183fc9b628f26276a1b1283ce0a5db7bf1a35092a84a86efa1454a933bd6f136550b961ba1edd298cad7174358a0fcf33e16a6d6
SSDEEP 768:yFQgQpwg3uQtGexe1lXDvNZoet4Oi9P6B:JgQvuWe1lXDs1Or
TLSH
T145D25C31D8A8CEB7ACEB9FC5A7497646EEF051A3D4D85AD4E6D88E0C00C75AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 15d5efe35a3a134ab353489c9ff3a6bb2c08be223654a4db42edbe13b37dd543
MD5 bce361f779d18d2106163c33647d8931
SHA1 68b3795ab657ededcd7f1e9551ad4ea50b059206
SHA512 8c1cf507402ec02611f731607c0792ce895feb3511b7a70f424a2660ca46f12a6457389aad078c14d1937377bce8b82fab916634f5117024771ad55a54821f63
SSDEEP 768:fF1j+9SX6wgUu/6Gexe1lXDvNV6FTAV5X5i:W9SXbuUe1lXDeFTkpi
TLSH
T1F5C25C31AC55DABBEDE68FD9B70A7A06EFE0519384D86DD4DAD81E0C00C72AD0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f84e050ebf5223318149873ca129bd38add9a50bf2732ca103701dd2c6690972
MD5 a5dead4c7587270a7a5584c9e4650218
SHA1 eb2a8c16be52a3b417600f7f563a13f4d27e2d39
SHA512 680344c6e18915d771c3579d52e9d609a2688cc53268f348d81dc3d0cd9d670d43b0b909ffedf94f8a055bc1512d9678ec8251418f26afac4de392efb1b03533
SSDEEP 768:SFQgQpwg3uXtGexe1lXDvNZoet4Oi9P6B:pgQvuZe1lXDs1Or
TLSH
T1B1D24C31D8A4CE77ACEB9FC5A7497646EEF051A3D4D85AD4E6D88E0C00C75AE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 88b3706ce4342b3aae7d2cae689c67c2cc08cc1a82142aa2d20765799b16782c
MD5 1cf92343660e419985e1ee9a56e1b79c
SHA1 105e58795c48de5277ec4c44cbb1ac8248156763
SHA512 0a854f9cbc87a8e3afc56c0a64009556539cf225c40fcd54fff94972acc71aa5f43478999b3a8fba3dbb98506752e8f292527efe7827ec2f4f4e3f232ed3ff50
TLSH
T1CE3121E08C391AC1D4BE0DAFB44B25FC94E89326F5D034386859ED68967D65E354087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 004caaa21520df5124231909d0fcb3ce34b8499f4a23c1639b90c5aae94a17f5
MD5 9163faae5844d6e074a89c9d923d519b
SHA1 46c1227e4e137de9883d55e07f11326ad7f7bd98
SHA512 c0c6aa4a7b4abc7fb7fb64051fbcbd46a5462fd373d0cc57d70c41fa2a88b84f3356852aed80ad87cddb6cfc324d8314df79d41a97bbacd924df93263d1316e6
TLSH
T1973141E08C3D1AD2D4FE0D6FB44B25FC94E89322F89434386858E968963D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download