61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260820-ejhp8sel6v
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1688	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1044516526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1283644157\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1283644157\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2001910063\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1044516526\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2059697868\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2059697868\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2001910063\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2001910063\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_2001910063\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5528	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316718981289462"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{67BE828F-CA66-447B-9185-F5B973E96D22}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6512	msedge.exe
6512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 7012 wrote to memory of 1688	7012	iexplore.exe	90
PID 1688 wrote to memory of 6676	1688	msedge.exe	91
PID 1688 wrote to memory of 1952	1688	msedge.exe	92
PID 1688 wrote to memory of 5528	1688	msedge.exe	93
PID 1688 wrote to memory of 1952	1688	msedge.exe	92
PID 1688 wrote to memory of 1952	1688	msedge.exe	92
PID 1688 wrote to memory of 1176	1688	msedge.exe	94
PID 1688 wrote to memory of 1176	1688	msedge.exe	94
PID 1688 wrote to memory of 4940	1688	msedge.exe	95
PID 1688 wrote to memory of 4304	1688	msedge.exe	96
PID 1688 wrote to memory of 4940	1688	msedge.exe	95
PID 1688 wrote to memory of 4940	1688	msedge.exe	95
PID 1688 wrote to memory of 4304	1688	msedge.exe	96
PID 1688 wrote to memory of 4304	1688	msedge.exe	96
PID 1688 wrote to memory of 1508	1688	msedge.exe	98
PID 1688 wrote to memory of 6276	1688	msedge.exe	99
PID 1688 wrote to memory of 1508	1688	msedge.exe	98
PID 1688 wrote to memory of 6276	1688	msedge.exe	99
PID 1688 wrote to memory of 3016	1688	msedge.exe	101
PID 1688 wrote to memory of 5984	1688	msedge.exe	105
PID 1688 wrote to memory of 4296	1688	msedge.exe	106
PID 1688 wrote to memory of 2448	1688	msedge.exe	107
PID 1688 wrote to memory of 6932	1688	msedge.exe	108
PID 1688 wrote to memory of 6932	1688	msedge.exe	108
PID 1688 wrote to memory of 5592	1688	msedge.exe	111
PID 1688 wrote to memory of 5592	1688	msedge.exe	111
PID 1688 wrote to memory of 5928	1688	msedge.exe	112
PID 1688 wrote to memory of 5928	1688	msedge.exe	112
PID 1688 wrote to memory of 4700	1688	msedge.exe	113
PID 1688 wrote to memory of 4700	1688	msedge.exe	113
PID 1688 wrote to memory of 6512	1688	msedge.exe	114
PID 1688 wrote to memory of 3324	1688	msedge.exe	115
PID 1688 wrote to memory of 3324	1688	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff98efec188,0x7ff98efec194,0x7ff98efec1a0
    3⤵
    PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,3477190383516565725,6042747703116601623,262144 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,7685796280435175924,15365331316439780063,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,588055849034833084,16268230614514930791,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,15318740334478689037,16688912367744767340,2097152 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,10572123825819022649,6276288541742579747,2097152 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,13841187756349500890,8837949843117127814,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,12514897217925305282,10444554419224987405,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,1043541170623387729,16520317499316136577,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,1043541170623387729,16520317499316136577,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,6607689176560403700,13015691413210394256,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,16986751185830186393,12593779317304549468,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,8101161981958709910,12084260042728684792,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3417773254849067551,12212332049337758317,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:14
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,848092522639118970,9788756199353956009,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7586289023496788976,5382647025549246797,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,596036025818877787,3319378377784638908,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,9779678984442037162,12733582976921215741,262144 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,5461463743567337332,11134709493257214227,524288 --field-trial-handle=2732,i,16290401618654860034,4464136564683797197,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:14
    3⤵
    PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 85f74664abc6dfc6b1995e4072dfc3c5e648a37750fc7ea851be42dd62af8f52
MD5 8aad6b8092990efec03a698341f98a8a
SHA1 fbb261138f0da3161707dea40742c1868a174944
SHA512 afa5429efbdb6fefffa91ed1007101cc00aa642590cd75014d9ef6638f4eaee19b87034be95939f691f04cf08344ca77335e8014d84a4cdd6720871fd067ea1a
TLSH
T11CE0E596D861AC375AFC1B2860941747E744131B3A40890F3A3C812C8FB06374387C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 73aa92dbb8fd7e2cb09e4382f03bc4536b4f235e9c91a731ba70674fba589145
MD5 cf659f08feda0ffc5a7a36060cdf3a58
SHA1 d65fcdbb2d5d7e06b0c863048f6f7707b2c8c85b
SHA512 1cd1f6596ffbf349d30335278e5f2ecdcb5b19d9cd960baeae14ce1cd64a226cbc08e8835399d7e1b4b3f3ccebc79ae91a9caeaf85b305e1e0102da3612683aa
TLSH
T1E641A0F783F4856EDA1195F0AA18BE2FCE2D0511432C7D9A89E4AE2793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f679720a4e86724d8f01b0249bf17664b518f49f621ac6fe4ef1b9d75c99030b
MD5 c25090a65ba7c9d8f1469d041bee139b
SHA1 1580c20b1fabab27c375ee692be4ca61099d8d88
SHA512 63bdb7369e94946bc385b85e1ffdee6724805ec43e02fab0ca0882783097a328046556f023fcf667f6b988715f098b78e28fad8106598be3437ad831282b9160
SSDEEP 192:sxRwRQyMqZjK1Ml8wCe/f5svNrNRZRIJbzoD8pej/g6+WNIYcC4xnlsGQMGhIgj0:sxRwh8e/f5s1rN/RIJD0/5IW4HsGQ1j0
TLSH
T16A72E8156A389D7BCCDBD219FA957F93D7F91133A1905E44AAFC8A0C04E66EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 dd30fca9a9539f1cd012a0fb846b18f8ea2b4c5ee57ba82c75448679eb98615d
MD5 bd4be417f3f96c6b938d786074f2b6cc
SHA1 e5333197a704b0829ea9b7f0ae763297d4f18e79
SHA512 311557a557a04ffbcf1c444c541e0b8eadfa9b6d017a854ff500fe4eb12de7107d792a07b1660e4fc920c59ae06c76b7ef9f9c8bd9a1a34f8ba23a5f71360924
SSDEEP 384:sxRwhqEe/f5sv7N/RIJD0/5IW4KsGQ1CPe:ssoEe/f0xWi/5IW4KsGQb
TLSH
T18A72E815AA249D7BCCDBE219FA957F93D3F91173A1505E44AAFCCA0C00E66ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d43413c2d8180387bc8e57e3383d7086928afbabccf1e799028e37cb308293a0
MD5 6b0c3e315435519299879c8ed5f8001e
SHA1 dd85366d89efc04c7b4b4ea34534e30732ba363f
SHA512 ffb2746e255d78b30c7641ec39cc0ea94a33978f14e0566d41fa12ecd306bda20938981152f1b1c01b61b52436f82af8cd6601ba8b66503d337525e41d323354
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJobbDwzrot4No:Ob4YZnE7yTWg1NfwBu1ja+obHwACNo
TLSH
T1A7E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9dcdf9cbf9c7ee6606b48ca8b1545801f4e5fefae21077460148e810b0c4d1e4
MD5 fea21362a059320a361a7d6d030d774b
SHA1 3c16f42a4ccf514063cb6586383a9d813634053e
SHA512 e6c19adddfb680b3fada624caba08c1b52e021e265f7d5b203a51d9c8e16e065b71397d51a514db3c0c64bb37135c2c98b278dd67f1943caf6d823f2d8b05f05
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9Jbh:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR+
TLSH
T149B25E11713F4280383EB50C91B8981F96C2B4A37519F52F7BA846A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a718af5b2b2c6b8fd88bbae3f463acecef214d95867070e9b1e79e4e99fe2e8a
MD5 dc5db86aa0899b88f4879be031ca736a
SHA1 f6284f655be7f3eef5ae8b692bc3e9f67b5b98c9
SHA512 8244b9295cdc3898432e041ac9592e63287ec9777e6477f08f6b2496706d567f6172bd821f1680aa0fef781b5566974421a0bf72a9d7e194754cfa5b67d250e9
SSDEEP 384:nYiFiZcIG8NL48TUNTUlIRAPvuTvnMVeffoGGcuDgWcjYxIWbrvHKiveUC8LEEIA:jFQGQ4wgKuDMGGzDcsdHPKiZ+s
TLSH
T1EBC23B31DCA4DDB7ECEA8BC5A7497A46EEF4116385CC99D4D6C85E1C00872EE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7f9bbddd00da10384560f8128b7ca00f2ab1b33fa74e4a57886719b793963f91
MD5 cf33ebdf4b56529a4aec29e8fc720384
SHA1 17c10c574cfff71a949ebd74b675a99d10c7550e
SHA512 cbeefb3a9e18c62728dffa4de9e0df5134ff76d0af36511358c86f7ae58afd20a403d00369cff80b9a776b67958e774d3a05baaea09638f7ebcc2e1aff0e4b49
SSDEEP 384:n1iFiZcIJ8NL48TUNTUlIRAPvuTvnMVeffoGGcuDgWcjYxIWbr8TKiveUC8LEEIA:8FQJQ4wgKuDMGGzDcsdHIKiZ+s
TLSH
T179C23B31DCA4CDB7ECEA8BC5A7497A46EEF4116385CC99D4D6C85E1C00872EE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1d479876c75d415ac1ed0891d5836c000f57a9a16414626ea19a18228f0f522b
MD5 04a084c7b136396e309073e2d9f6ea36
SHA1 de339b7a3dc15a94f5946bdfbba9ddda6a7e8c11
SHA512 8af6c344b67f4b13e3f1670cde701d58c45bcf2b4cdde2fa325cbb2b1e7d05bfdd0fc0ef2c200b3a2b94a4b3597040b274e441600ba7f7fea1b8d83764008603
SSDEEP 384:n2iF1tNn/s3n9Sn8NgV8TUNTUlIRiPvuTuzReffoGGcuDgWcjYxIuLDFO6AV5XMJ:dF1j+9SXVwgUu66GzDcsXDFTAV5Xjq
TLSH
T120C24B32EC65DABBDDE64FD9B30A7A46EEE0125781D859D8DAD85E0D00C72ED0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6e9fc113656745cf5105b8a12e937be994b0a76b3e65c9246ad5b4966e365ba2
MD5 b932b9cc9b53196d63f52625c5009741
SHA1 955847bd9df78fd80b13c0ce13a1815553edb2cc
SHA512 a4dc44650d03602eb8b96a0ef391a55c50b0e44279a51528480535a363299b8485f0d117226022d09da88a4cf513314198f45aa3e2378419927a57b648604251
SSDEEP 384:n8iFiZcIJ8NL48TUNTUlIRAPvuTFMVeffoGGcuDgWcjYxIWbr8TKiveUC8LEEIzE:nFQJQ4wgKuOGGzDcsdHIKiZ+s
TLSH
T136C23B32DCA4CDB7ECEA8BC5A7497A46EEF4116385CC99D4D6C85E1C00876EE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 43241138c97d53892992bbf1357522bdc26c56077da0e4c1301a7eec8edc6bcb
MD5 eea8247f798e277d53e3654e1911c0cb
SHA1 cd88d09ecb59209d622dd623ff488750ed226425
SHA512 f03b71903582e635f2ae47f7ced771ad894fc9cb23b3388f7519429d0d824672f3443084a44afdb91e12b441be1e8da9f5f536e0e5e608aaf64ea70e3207b27a
SSDEEP 384:nGiF1tNn/s3n9Sn8Ng48TUNTUlIRiPvuTLPVeffoGGcuDgWcjYxIWbr8kKFO6AVY:tF1j+9SX4wgUuXGGzDcsdH1KFTAV5Xjq
TLSH
T18DC25C31E865CEB7ECE64ED9B34A7A86EEE011A3848D9DD4D6D94D4C00C72ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7c4b2d8-6a4c-4bcd-a501-a6b956af4786.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e7c4b2d8-6a4c-4bcd-a501-a6b956af4786.tmp
Size 1KB
SHA256 e2c84ba1bb38bfeec96ad6b1a5e39cbdef1166f4f34c4f103252576b1537f333
MD5 e3a0e7a0bf80d0ae0fdd3abf4d60f3cb
SHA1 3a291d6ca5222dbfe0b2e675b49961f6a2d82b7c
SHA512 00e19f7c8209246bb7957c5ff8dec766634c01ec4dbab4b0123520e0d2542db7bd6d5d7f9bd1acfd123c7be804642035c41011e53346fc78bb1b980d5fe0fbe0
TLSH
T171311FE04C3D29D5D4FD0E7FB48739FC94E89726F8A434386898E968966E61E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 88b3706ce4342b3aae7d2cae689c67c2cc08cc1a82142aa2d20765799b16782c
MD5 1cf92343660e419985e1ee9a56e1b79c
SHA1 105e58795c48de5277ec4c44cbb1ac8248156763
SHA512 0a854f9cbc87a8e3afc56c0a64009556539cf225c40fcd54fff94972acc71aa5f43478999b3a8fba3dbb98506752e8f292527efe7827ec2f4f4e3f232ed3ff50
TLSH
T1CE3121E08C391AC1D4BE0DAFB44B25FC94E89326F5D034386859ED68967D65E354087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c79a0af5c7980899990b5a650050ab2dd34e18d0bc7b8cbaca2c5405b698826e
MD5 d5b69568d2c9f41d606b038a10a959d8
SHA1 271106fba04dbde8a5be712d103c636cd5c17738
SHA512 e4427219a07c44e3a89341ea345d44cc7efe3bfa9aa6f8c5b08b9dd133ea133661f5abd0a8579d26187ec785c1e80969ccb57bd504f9558f10b3b30834192fce
TLSH
T1CD3131E04C3D19D1D4BD0E7FB04725FC94D89226F89434386859E968963D61D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 004caaa21520df5124231909d0fcb3ce34b8499f4a23c1639b90c5aae94a17f5
MD5 9163faae5844d6e074a89c9d923d519b
SHA1 46c1227e4e137de9883d55e07f11326ad7f7bd98
SHA512 c0c6aa4a7b4abc7fb7fb64051fbcbd46a5462fd373d0cc57d70c41fa2a88b84f3356852aed80ad87cddb6cfc324d8314df79d41a97bbacd924df93263d1316e6
TLSH
T1973141E08C3D1AD2D4FE0D6FB44B25FC94E89322F89434386858E968963D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download