22449267919b4057418022121aea0b6cdb030d7583290d26085534f47aa43a8a

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m4-eL.svg
Size 3KB
Sample260816-j7arratcle
SHA256 22449267919b4057418022121aea0b6cdb030d7583290d26085534f47aa43a8a
MD5 ffd188160146fda63495f76c915854b8
SHA1 09601cd3c4bef976ca683b68265fc2a4e14c5611
SHA512 91a977f2fa58fe62436789064706aec5af63e3bde95527e33e5f26fad7233b1251035739ed0256f88470437cfb9aaac867f0b0f10b180955866570671e3eacc7
TLSH
T1F771388876F87EEBC7D802570D51D8B80B2F946BD422978DD3CB94D875282AC735D570
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
7044	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_504794799\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_289842208\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_551217014\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_551217014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_1146226619\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_1146226619\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_504794799\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_504794799\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_289842208\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7044_504794799\keys.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4104	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313418992800834"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{BCE6AB9E-34CB-4BDE-B4C0-CE36EE191234}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
7044	msedge.exe
7044	msedge.exe
7044	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
7044	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 6536 wrote to memory of 7044	6536	iexplore.exe	88
PID 7044 wrote to memory of 3140	7044	msedge.exe	89
PID 7044 wrote to memory of 2420	7044	msedge.exe	90
PID 7044 wrote to memory of 4104	7044	msedge.exe	91
PID 7044 wrote to memory of 2420	7044	msedge.exe	90
PID 7044 wrote to memory of 2420	7044	msedge.exe	90
PID 7044 wrote to memory of 3228	7044	msedge.exe	92
PID 7044 wrote to memory of 3228	7044	msedge.exe	92
PID 7044 wrote to memory of 2924	7044	msedge.exe	94
PID 7044 wrote to memory of 1160	7044	msedge.exe	95
PID 7044 wrote to memory of 2924	7044	msedge.exe	94
PID 7044 wrote to memory of 2924	7044	msedge.exe	94
PID 7044 wrote to memory of 1160	7044	msedge.exe	95
PID 7044 wrote to memory of 1160	7044	msedge.exe	95
PID 7044 wrote to memory of 4764	7044	msedge.exe	97
PID 7044 wrote to memory of 2648	7044	msedge.exe	96
PID 7044 wrote to memory of 4764	7044	msedge.exe	97
PID 7044 wrote to memory of 2648	7044	msedge.exe	96
PID 7044 wrote to memory of 3420	7044	msedge.exe	99
PID 7044 wrote to memory of 5528	7044	msedge.exe	104
PID 7044 wrote to memory of 1296	7044	msedge.exe	105
PID 7044 wrote to memory of 4580	7044	msedge.exe	106
PID 7044 wrote to memory of 7032	7044	msedge.exe	107
PID 7044 wrote to memory of 7032	7044	msedge.exe	107
PID 7044 wrote to memory of 3700	7044	msedge.exe	110
PID 7044 wrote to memory of 3700	7044	msedge.exe	110
PID 7044 wrote to memory of 3940	7044	msedge.exe	111
PID 7044 wrote to memory of 3940	7044	msedge.exe	111
PID 7044 wrote to memory of 4684	7044	msedge.exe	112
PID 7044 wrote to memory of 4684	7044	msedge.exe	112
PID 7044 wrote to memory of 4492	7044	msedge.exe	113
PID 7044 wrote to memory of 6328	7044	msedge.exe	114
PID 7044 wrote to memory of 6328	7044	msedge.exe	114

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m4-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:6536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m4-eL.svg"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x32c,0x7ffb88b1c188,0x7ffb88b1c194,0x7ffb88b1c1a0
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,3883942246252339488,651917599703485440,262144 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,9464563452431581111,3315701187971515082,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,9298215184276859872,7681074615527399849,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,17950640285080937301,8589908910456621932,2097152 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,1730880591172367671,17759148203014506253,2097152 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,13205235764123183569,14522785195737743952,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,3697378209973207853,9396670033132026132,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11542204598395722290,17101353762152071752,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11542204598395722290,17101353762152071752,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,688387182730288966,15093241949834853512,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11858755259537028200,3935988067262090858,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,2079406830743376034,7312683803832043413,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,11240736264636830355,5778958953639314197,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12910400838875779724,1070316486986774570,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,9046400758349072243,11085284429169678732,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,13749033403574940762,3443867006411555085,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6600,i,6155144967093203262,15684662304921604174,262144 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,4298935738574787828,15897114547065066209,524288 --field-trial-handle=2304,i,13405032262307113415,15771997259293001003,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:14
    3⤵
    PID:6328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 aaf43debe8aa55bb15d6087ef2d7ceaee6aefb54021366112f174aafc7588f6a
MD5 14de7dad32bc0ed2fc0a7e7f3073de66
SHA1 c9551431433d986a0786207bc40f105f8a67f94d
SHA512 5c47cbb5c74f5e35e4769554ac0d323e8a00ed1267010e9e903b2b9d9d25c324b22a72f8f67a78b746dcb2b325ff0371faa53b2e24d4cb485428872ee10adbe4
TLSH
T115E0E595C961AC275AF81B186094164AE744132B3A41884B7A3C922C8FB46374A86C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

44892d88-8b01-4a48-a99e-09c25c81f34f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\44892d88-8b01-4a48-a99e-09c25c81f34f.tmp
Size 2KB
SHA256 5c7c71da8c63b5d131d9c68d2f970971f097d46cdcfed4c32ca773a8c9ce58a4
MD5 ad978bcf49bc3a98bd5c5d44087625fa
SHA1 e449549af5d2026adce849ad43245471f5401ba3
SHA512 4965a791e164d015150ca3b9baa2baa0e2719e0da190b932049abbcdb8856a9fe45650c4a434b7176a641f75304ccfcabe2ccf45938d35790f8e8b65c81281a4
TLSH
T13C41ADF383F4856E8A1196F0EA186E2FCE1C0511432C7D9AC9E0AE6793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f841f119bd33fd9435a24f3a39ea7a152cfa9d1193ecd35f0324b4b83ef2beab
MD5 94da759591924bb506b397661883b063
SHA1 eda274b678feec0691d024081181fa25be2deb6e
SHA512 29778b98b0c8b97085ada6cbe579032f415ce4ba531aac196bbd9ca38c3ceee787f6fcd6a38325ed0a8279c41cd82c89bf4b5b2b34c5eb4e05a07c1c328b9e0f
SSDEEP 384:sxRlEq+9/fJsOkaPN/RIXPn/5IW4tsGQXOx:sJT+9/fuaW//5IW4tsGQu
TLSH
T18372D8159A285D77DCDBE219FA957F53D3F8117391905E44AAFCCA0C04EA6ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72d99b90d9eae481e1e2da2749eb154370d7ea74e67d45f468d2b26f93206c3c
MD5 124e92aa1658506c1cb8f41edd19bffc
SHA1 64b5902d669411c45271027f6f262e6728ccb7d3
SHA512 c6787caf1ee18bdf0a089398f8adb1f920e8503d79ec657882d58c30d744cbbbfc7311f9350be0e792f773205bcc6d09bc3cfa366d679ede54cab7ce4cb99403
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroi4w:Ob4YZnE7yTWg1NfwBu1jasobHwANw
TLSH
T11CE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ca5252bc889a6e168ebfcc3d53665ca947202d583807ad39f6232196df24a6d3
MD5 010eeb658a8123d964881d6385d7aacf
SHA1 2020b8ddb678116b7b7083c1fddff4f80a4dda43
SHA512 82bdee7abe607e0c6b08f35f97680bca9da0c9b66868ce7f249359bada18eab71d5270401ea65471ea3d77d3e6571993e972e352bb876b6d5c09cb5bd17590b1
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9h77:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR4
TLSH
T17FB24C11713F4280383EB91C9178981ED6C2B4A37519E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab8c3911-696e-4621-b4e6-0a4952330fc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab8c3911-696e-4621-b4e6-0a4952330fc5.tmp
Size 15KB
SHA256 4c08c4a794f7586cc4f49b5f1428332c66ed63537a21702657f08c354b76e99b
MD5 b343482ef92fe07609345d55416b6d02
SHA1 1c128c767402ab38ee6156049c28021fb773452e
SHA512 17f1e0d14de8226964b8671886f6850e3d40388ff8535754d5c7f0d2ac1eeb3ed673773c413785ed333f142c79f4b48afa39d6c9307e9143f1b5ab0bf752d0ad
SSDEEP 384:sxRlE89/fJs0kalN/RIXPn/5IW4JsGQXjQ:sJB9/foIW//5IW4JsGQs
TLSH
T18C72D8156A289D37DDDBD219FA957F93D3F81133A1905E44AAFC8A0C04EA6ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 82398f0135a3a373acd6f8458184a7ce87ebecfbd789536b6c0438becac9f1ad
MD5 09ce20c29af221bc62677f0a0b4922ae
SHA1 13400886269a4059c0f7db080a35f56deaadc316
SHA512 5a5bc421e84e0228370b0a81578cb5476fe0083b5cad9f5cad00e18cb3cf6694932a5e8622e530e3963005d47258853d6bc12f3aac5d25e355b228e91889afcd
SSDEEP 384:nriFiZcIz8NLa8TUNTUlIRSPvuTkFtuEqfbYG8oqGqrANGOOPrXLpe8C/WtS8LEx:GFQzQawgAueXG8DGUOGOi9PbtO
TLSH
T1A8D25C71D868CDA7FCEA9FD5A74A7646DEF41163D4CC8AD8D6D98D0C00871AE070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3f3896143604269fe93bf25d3a2e8290ddd7fc300b785dd8c9451321b0197ce0
MD5 042dd736f63f3b8157c1ab7fa82ea6f6
SHA1 213f2fcb8b91e382470a5e277ebaf4f80ba05571
SHA512 17bc2dd3e1bff1ef826bf42d89b6fbb67954245436fedfdfb463db0f26821632b5df0600b4d3cc719739e1e6b7fcf7f5776b41b0d989d2bbcd3114731b527399
SSDEEP 384:nhiF1tNn/s3n9Sn8Ngc8TUNTUlIRiPvuTu6REqfbYG8oqHLLOObjI9G6w7aijh83:IF1j+9SXcwgUu3UG8DrL29MaWa
TLSH
T1A3C25A36DC55CEB7ECE64F98B74A7A56EEE0126384D85AC4DAD81E4C00C72ED4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9343f37f9dca63903ab04b9f3a2406a41b70847245393d4c93df49c7d2b3826c
MD5 d68ed1b0a19ca8cd24ab2f298f73ec56
SHA1 a862358a91ae19c1bc77c98d922e35971b8c5acc
SHA512 413f89fbed1729258e619f910288d3ed645f0ecc17dcbe3510eea69249060398bd1df2e919691ab548e8e0bc80603f97e00f239b43637820befb6f04c236018f
SSDEEP 384:n4iFiZcIR8NLa8TUNTUlIRSPvuTkFtuEqfbYG8oqGqruJGOOPrXLpe8C/WtS8LEx:DFQRQawgAueXG8DGUMGOi9PbtO
TLSH
T1F3D25C31D868CDA7FCEA9FD5A74A7646DEF41163D5CC8AC8D6D98D0C00871AE070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f02d0309162787954de1b92d83bdcd1bb413927c3b9c8c626a673d4b09bb86bb
MD5 c183cfe034d0f7bcd0cddfa9b0ed56ca
SHA1 00b575f3adb2a7e93bec98b7fec88b1a88d9e86c
SHA512 8878b9be8b6961f931a20fc3b7aa407120aec8218f9eef2ecb772dad6d495bc10e8ea0bf61acd2f5000d62609b82956e309390403ec89ecbb362e6d74ceb1777
SSDEEP 384:nliFiZcIR8NLa8TUNTUlIRSPvuTkFtuEqfbYG8oqGqruJGOOPrXLpe8C/WtS8LEx:sFQRQawgAueXG8DGUMGOi9PbtO
TLSH
T14FD25C31D868CDA7FCEA9FD5A74A7646DEF45163D5CC8AC4D6D88D0C00871AE070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1c277fc1dccb3caa272c5e082bc58912a0ee9730ea8905b2e9940aab7699ffab
MD5 ef46cdd19f2d755c4f39d578fecfd187
SHA1 4b05f333a968bc0ac9d3d6f851429df3c251d5da
SHA512 d17e0b82cae7d561eeba87d2fef9728b92875b05015756410e69379d36cf0c03e26d0a0f6e9c4b8e6114c717cd5079afadba64cfdfb40aa646423b9a01c1420e
SSDEEP 384:nliF1tNn/s3n9Sr8NLa8TUNTUlIRSPvuTiFtuEqfbYG8oqGqruJG3ek8LEEIzPi:sF1j+9CQawgAukXG8DGUMG3q
TLSH
T144B23A32D855CDB7FCEA4FD9B70A7696DEE01163848D49D8DAD94D4D008B2DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 577b0af1aa49d0144a27aef3ec59b2bd55a092c2275f2aa9c2d2e0e6d1c0d6c4
MD5 ce2227fb87d0413f242b3bbb28e2bc1f
SHA1 8e89dc91177bdf5b48f741f4e61b8927c78af483
SHA512 2428c76a1b2074037c04ed6fdbe1d00dacc5ccd0d21b8bb17643525ca030fc0497c3cca219f49c356a6b606b3ca3b93f20b70be2471180c1a3d35c475a6f271b
SSDEEP 384:nuiF1tNn/s3n9Sn8Nga8TUNTUlIRiPvuTQmtuEqfbYG8oqGqrukGOObjI9G6w7aR:FF1j+9SXawgUuRXG8DGU3G29MaWa
TLSH
T11BD25B32D855CEB7ECEA4F95B74A3A96DEE0116388DC5AC4E6D95D4C00872ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 26b91053fa5665c7f9dfbb70dfa8cf3e30ff195b27be968ac53fffddc337337e
MD5 f36fd20686b0cd08c1cc0cc0d1748528
SHA1 40bbca940bb397d8fef4133608ca78249c95c275
SHA512 4fa2c486c992eca274f7376f10e9a676e97bac60efdc8a18b36871bcfed51fe128d520e6e1742bd6698b2073c0305ec0e71c7ef1aa6c873a54118b55d6f8a219
TLSH
T1D85150E04C3C16D1D4BD0E3EB08739FC81EC9725F890343C6859EA585A7A21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2f114d75a9cc6c7f1c466c3950e9951b03f0c375ccd0b1955072417997d5a019
MD5 d01a5c504c32e07b1caa569c652a6a20
SHA1 f0df32d4e03c5f5399edd122a28295f326be6681
SHA512 58ebbc60aa6b17453e7f1bd87854bbbb6fb7f93dace233f7934e151af24314152cd57aff649b8dc556e4f8a84be30f2250fbc5e5e6a0876ad737e935561b9ce0
TLSH
T1FF512EE04C382AD5D5FD0E7EB08739FC81EC9726F8A434786858EA5859BA21D249083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 08a293f1583d129c9e975f00f9f365bb366b9023bcc15b3612fa8cb7a3ef3e15
MD5 6a812c11f55f0456e0e0b26731680073
SHA1 843157812ee131255015c3bfa9b8c1411934d3f9
SHA512 00f516a51d1a92f8d24d8bde435a82a3ad9996b99efbbc760c7c172fcd6bd4708c0c59832474b40d0c3b04625d3fa60050b627fe415365d339382115061f24d1
TLSH
T11C515FE04C381AD1D4FD0E7EB48B78FC81EC9726F890343C6858EA985A7A21D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download