e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eL.svg
Size 3KB
Sample260817-qb4taa1cmd
SHA256 e22854a5f93a9bce2c8dcffd9e177925074bb0e0972566d673e4b83022c9a46c
MD5 735c5dd9687af27db46d1760af81d1a5
SHA1 0362449843acc75186d102a08af6cf07a5b90853
SHA512 26772d0a891c6a143982ad5a722edd3afac15222392ad8c66bec616770bd539ac0f223fe367a8615d39c4c5ff3ffbaccfd34400adc4c2fd98fac718edffb22b1
TLSH
T1AA71288876F83EEBD7D802970D41D4B84B2F946BD822978DD3CB94E875282AC735D570
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5716	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_31410589\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_922818988\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_720769621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_720769621\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2104362299\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2104362299\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2104362299\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_2104362299\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_31410589\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5716_922818988\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5516	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314455812707225"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{BA94FA79-8F7D-45D3-9A04-F19DC63C428F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5716	msedge.exe
5716	msedge.exe
5716	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5716	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 5716	3228	iexplore.exe	90
PID 5716 wrote to memory of 2436	5716	msedge.exe	91
PID 5716 wrote to memory of 5516	5716	msedge.exe	93
PID 5716 wrote to memory of 6996	5716	msedge.exe	94
PID 5716 wrote to memory of 6412	5716	msedge.exe	95
PID 5716 wrote to memory of 6996	5716	msedge.exe	94
PID 5716 wrote to memory of 6996	5716	msedge.exe	94
PID 5716 wrote to memory of 6412	5716	msedge.exe	95
PID 5716 wrote to memory of 7068	5716	msedge.exe	96
PID 5716 wrote to memory of 7068	5716	msedge.exe	96
PID 5716 wrote to memory of 7068	5716	msedge.exe	96
PID 5716 wrote to memory of 6948	5716	msedge.exe	97
PID 5716 wrote to memory of 6948	5716	msedge.exe	97
PID 5716 wrote to memory of 6948	5716	msedge.exe	97
PID 5716 wrote to memory of 2236	5716	msedge.exe	98
PID 5716 wrote to memory of 6772	5716	msedge.exe	99
PID 5716 wrote to memory of 2236	5716	msedge.exe	98
PID 5716 wrote to memory of 6772	5716	msedge.exe	99
PID 5716 wrote to memory of 3572	5716	msedge.exe	101
PID 5716 wrote to memory of 708	5716	msedge.exe	105
PID 5716 wrote to memory of 1856	5716	msedge.exe	106
PID 5716 wrote to memory of 3620	5716	msedge.exe	107
PID 5716 wrote to memory of 6544	5716	msedge.exe	108
PID 5716 wrote to memory of 6544	5716	msedge.exe	108
PID 5716 wrote to memory of 6164	5716	msedge.exe	111
PID 5716 wrote to memory of 6164	5716	msedge.exe	111
PID 5716 wrote to memory of 6064	5716	msedge.exe	112
PID 5716 wrote to memory of 6064	5716	msedge.exe	112
PID 5716 wrote to memory of 3920	5716	msedge.exe	113
PID 5716 wrote to memory of 3920	5716	msedge.exe	113
PID 5716 wrote to memory of 2776	5716	msedge.exe	114
PID 5716 wrote to memory of 6524	5716	msedge.exe	115
PID 5716 wrote to memory of 6524	5716	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eL.svg"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8b120c188,0x7ff8b120c194,0x7ff8b120c1a0
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,1114536459125271730,1102213793387897218,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15242062274847668730,1260807216445792641,262144 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,1048640444769742991,4670815066069003307,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
    3⤵
    PID:6412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,13569887019707635503,16816418168609005764,2097152 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,4367252516310301645,1246498010532147703,2097152 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,1939200109416359149,4431978114772988868,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,6330750871284025739,12947092940155490762,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:6772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14436901942636303138,7380261415973064331,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14436901942636303138,7380261415973064331,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,6422576570245018153,18000548668935937785,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,3552830998216511798,12703882138206223215,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,4522449662546215198,6910699823455851406,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,12063989091742761004,17532260813216747545,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,8362627992357374327,5649499057037383803,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7107942700500949212,2726217424301584157,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6630903933147203937,10457151607202194597,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6032,i,17513199388110354587,1282337554732947110,262144 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5995497590209111370,1113160787492877420,524288 --field-trial-handle=2624,i,16622426263712462866,3717907985751592082,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7b217c5cc978c692a8ddbb506ee0a7a32df6686c5f072b3d88a6598436b1eece
MD5 b7627ef674bd13040c12a3cfd6987e50
SHA1 12bae50235b4474573c1081fe2f1c4032e0ead34
SHA512 331e0502dbf9df0812275979e1207ab5d1194ec4a9bf5e56d8307a68f588f7ecff4a8ac33b588ba714c7aaef6a6ff73c8ef393cd6398de6ce0b34edb838a8461
TLSH
T180E0E55AD860AC2759F81B2861944747E750135B3A51984F3B3C826C4FB46374286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a76607020aea87ed03a6d2db176025bba4819cdafe5522202b0fdabfc7bb9aa6
MD5 692332b83950e7fefddeba78e2d41b17
SHA1 a5688234a05a32eaa8eca16a6093d8ac0f3e6cce
SHA512 de530060597f8bde025bd654323aa1784b43dc65489dc99bb8723a47e8466bb48bddeb969396099294a19e02ec3cc9aff102571db86003f1718745447f44dfd3
TLSH
T18D419FF783F4856ECA1196F0AA18BE2FCE1D0515432C7D9AC9E0AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c5b1989c16083a5ec9815b2f200553c04198738922adf2b69f10493ae7edc2f2
MD5 7ce1c51f3dff041c2696e051c7d77989
SHA1 d18b4a9082f2ef6583eff0b6ca136a006d9769d3
SHA512 1aa1b19de7596e6e19ead3457fcb99cbad56a3961792ba58a734c5fcb9b4f19cffad249fd50cfbd7423114e55ff38d6d448ee8ce0ee40c8a5c625bacfda6bbe6
SSDEEP 384:sxRoTqdi/fSsF0N/RIwJG/5IW4csGQSH8:sEudi/fL+Wf/5IW4csGQ/
TLSH
T1B672C815AA249D7B8CDBE209FA557F93D2F9117391915E44AAFCCE0C04EA7ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3a2e29473a541fd0f21bdad076e6bf38cca136b57a345d91687f223ba58789cd
MD5 ad683b27b13eea01a8531e68fb5234b2
SHA1 0b2fed73e52dd299b28f74c6c1d562cdbbea8c95
SHA512 01376f794639ff5525dbe37636562c93a15168ef72940f93894749117182a8f3ade21bdf16dddfcda34e1848f737c1635a55a98ba09de57ddc76bdd83032dd4c
SSDEEP 192:sxRoROyMqZjK1Ml8wCi/fSsZ+NRZRIwtzoD8pe1/g6+WNIYcC4xfXsGQ8GaIgjXJ:sxRoT8i/fSsZ+N/RIwJG/5IW4hsGQSj5
TLSH
T18372E9156A289D7B8CCBE209FA557F93D2F91133A1905E44AAFC8E0C04DA7ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f39b250b909935ba0758acc703eb8f35e385a7a627b0a6ca69495ac7efdc0165
MD5 dd7541ba6ea0463d90582968f9b7ffef
SHA1 813984f74284c435d791288e47e7b367495c3868
SHA512 d38a544a41a14435b3ee6f09cfe4fc63124e456de6b24a122d21c6427e2fd7ce2a612e3ea53c53833cc22d56737e4672ec8d9ca95e541dba8d9879cd1521a4e4
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpobbDwzrom49:Ob4YZnE7yTWg1NfwBu1jayobHwAB9
TLSH
T1ECE2EC3B280CCB7E4F804ADDEC29BDDA6DA801CF56D8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c716f84e38bc559de1457b477f79759c619f8fccc76d24d4d15fa5123755ae44
MD5 52cf38a19fcc969421502f758074a2de
SHA1 31abc47743eb3488569ff268624ab37dc8a929d4
SHA512 9b4ad680640edce44f8f0191ed94ce8d82800f41fa57e1b1b743d80e675a6be643accde7a7b45a8be9c1b1a72344b0408cc4c5b461c6ce0711a20d25636b7be5
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9JV4:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRR
TLSH
T150B25B11713F4680387EA90C91B8D82F92C2B4637519E52F7BAC01A65F67E038DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 149254f5b667efb90a8a967d2131cdd7812972685e6d490d0726d8abc69c6cc3
MD5 cfd902ecf8f94ccac290d837d70d1d1e
SHA1 f53139fc4d0b3add1d71afad5615dbe727ee48f9
SHA512 44d6e42750d044bf73446e9a19a631e1b79f72612890925ec31d821710c7c3719c78517c9619d5acfb892160c91eb0a6d07692f813178fb04fb8ec072970b6b4
SSDEEP 384:nP1iFiZcI58NL98TUNTUlIR3PvuT+xAHeff+GGnR9nnFLE8BsOOPrXLpe8C/e8L5:0FQ5Q9wgZujwGRPBsOi9Pu
TLSH
T12BD24B31D8A5DEA7ECE79FD5A6497646DEF41263D4CC9AC8E9D88D0C00C729E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8b293bb3c6e4cb1b6b45a3d9c86d3575f6dcd1f80b99a12b07e17debf97aea4c
MD5 8e992025f3baea383f2400e0fd1a12d3
SHA1 85fd5642f1ddf44b66ff19101556a85fa14f891b
SHA512 aa64e3e2a525aa21b5e5887449f0c7e442258a32ff39b968051c5151e8d23de8ef994311ff829fba106eaf51621c0d50df1159c4714215bd169dddb31a360dff
SSDEEP 384:n4iF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTukReff+GGnR9nn/LBSOObjI9G6w7uWZ:DF1j+9SXOwgUupmGRRBS29Mj
TLSH
T16FC24B32DC95CEB7EDE74F98B24A7A4AEEE01267859C69C4DAD91D0D00C72ED0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 58b69da8ea679bd9a4ed11157753cffc03359f5a415c912d7358f3ca7fc99215
MD5 ebf4de7b24a1e076f61346d990cfa095
SHA1 6c69d18b2acc27660e441f86cb6338d646ec3852
SHA512 fdbe8fe21762dbc16e7db01186bbedf72b9b20fef38d039e70c50ccb79d7d0eaab54a85346d72dd8c3d4f5a61daf67599de1b56f13ae7f210ca78d7041be41d8
SSDEEP 384:n31iF1tNn/s3n9SX8NL98TUNTUlIRiPvuTuAHeff+GGnR9nnFLE8Bs+8LEEIzX/a:MF1j+9OQ9wgEulwGRPBsQa
TLSH
T1BFB23B32DC95DD77ECE64AD9B74A7746DEE002A388C99AD4E9D85D4C00CB2DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6d9dec45aa3c5e670e2fabdd5eb1c5f8d6064d41a17053a60a618d455368593b
MD5 d7f9d7afa9fcbed5d6d499342b4ce45c
SHA1 c193c95409ab6b40e995d4598ea22bbf92aa2322
SHA512 fa14c1027b1c8e56458ac293506b47bfa579143b967defdc0095b13576b7151dc89ce54c2fb97440400e1cda96d2116f5d04f07ebebc3c0a811ae7ca5a74c372
SSDEEP 384:n31iFiZcI58NL98TUNTUlIRCPvuT+xAHeff+GGnR9nnFLE8BsOOPrXLpe8C/e8L5:MFQ5Q9wgEujwGRPBsOi9Pu
TLSH
T136D24B32D8A5DDA7ECE79FD5A6497646DEF01263D4CC9AC8E9D84D0C00C729E070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 180c64974e6f4f9fbb3e09908cabcb3fc364eabee2207f2334f555224d831198
MD5 0ce956d2ffb06077e409a8a443be99c6
SHA1 3f4169b973c6063f93bd1b1f9d9c5f6c65143b67
SHA512 6878c9204108235ae79155120bb468dcf17d347ae2aa64ffb615f26d0823d1d91874c6935368fda78e52b9da3cb1c353ac2560c03a9235ec9ac1c503c5eb6658
SSDEEP 384:nPeiFiZcID8NL98TUNTUlIR3PvuT+xAHeff+GGnR9nnFLLsBsOOPrXLpe8C/e8L5:9FQDQ9wgZujwGRwBsOi9Pu
TLSH
T16BD23B31D8A4DDA7ECE69FD5A6497646DEF41263D4CD9AC8E9D88D0C00C729E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 04ba90bf7625d65eaddfada4c608b7dbb2369101e836b3cbf92ba7a22246df50
MD5 8a94031b38b4883a375cd728a6d0f9e7
SHA1 96c4db1943535dec76cbc979fc76cebce16ee29a
SHA512 5e740fb7a675aee436365478ddd955dbcf9f2113ae24b0eb8b0da718059df0be91a9b24f981025fc1e663a5b66f9fd6d524b714fcb2f0bc5e79c9e65a18a2cff
SSDEEP 384:nSiF1tNn/s3n9Sn8Ng98TUNTUlIRiPvuTPnHeff+GGnR9nnFLEkBsOObjI9G6w7j:ZF1j+9SX9wgUuDwGRlBs29Mj
TLSH
T1E0C25B32DC96CE77EDE74BD9B64A3686DEE012B3898C5AC4EAD95D0D00C72DD070B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b5e769e5b25284d5e2865afb6ae32449f75d8f838609bb622f00a158e4c45e1e
MD5 952567b416e1926518e8fcc659d457c8
SHA1 099643ab41de1dc0a723169839131328a9318436
SHA512 457461af40a68307129ef37d126a9f474660f61dc23804d6bea1a34b3dea836cbb3a64b41342eea9514ddf16e0689933de339e05a502f584da69ca2c2caaa6c9
TLSH
T10F4130E05C3D29C1D4FD0E7FB48729FC94D89622F89834382899E928962D60D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ada523f25a74c54a398124cfb0332a7d39c38c10e544601e0e1d37bd916c79f3
MD5 0f989aa48939a2ad9db3c42d157a591f
SHA1 96643fa4f3ac86a58dbd9d7d7f60e16300090c70
SHA512 c7656ca6835612a54fda263f03396a077a3a057ee3f7362f29313a4d6e31a7eb8f15e1dc848310316bdbe1e4ce517a3a33b5649ef7e288e2d6dab02f1adfba0a
TLSH
T1F44122E09C391AC1D4FE0D6FB44B29FC94E89722F89834382858E968967D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3df19836dbbdc5b1421ad8dc4f7e7e0e7a434d2617ad0282a47668f0071d5437
MD5 a3dcf738dc6e5ac7d9cf4e7251687726
SHA1 0fa66734ea4a1723e40fe030e1148e966da66236
SHA512 fb4e007caa73a0809c1153241a6cdc386c73ede299c669d8ebfb6b9e20367ab6c0a58a7a3d213c3c9260d7accb85def6356c041eac1f7d599b79602d986b1e9a
TLSH
T1984164E09C391AC1D4FE0DAFB44B29FC94D8D326F4D434382858E968963D65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download