1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v13M-m7-eL.svg
Size 35KB
Sample260908-lpc59sxcmd
SHA256 1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388
MD5 bfd57f9c04b8bfc4e5434bae690e2203
SHA1 e7b3435c094295274f0af2f8397f5bb45ea184c1
SHA512 6758b4a12d192d174ef164e40e6e9404b61b978a9fb28913f7bf0882d22b005217c3f048344f661fc2e264b7060e3cbe73503e4b546688f5342e8ae0eff3613b
SSDEEP 384:chMBVd+SOAKzMf2qACRnJPB/nafePgDOx48FAIddEIRisu:c2VdxlZdIV
TLSH
T19EF2306537F43C9B8BCC03479D42FC6C46AF98B78098678D97D790E8A548368F7AC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1535338936\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1535338936\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_137284999\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_463594065\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_463594065\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_463594065\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1535338936\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_137284999\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_463594065\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1535338936\deny_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4056	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333341401635475"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{8F755E0E-32DC-4804-96AD-E0FF071E1108}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6544	msedge.exe
6544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
916	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 7152 wrote to memory of 916	7152	iexplore.exe	91
PID 916 wrote to memory of 6508	916	msedge.exe	92
PID 916 wrote to memory of 6840	916	msedge.exe	94
PID 916 wrote to memory of 4056	916	msedge.exe	93
PID 916 wrote to memory of 6840	916	msedge.exe	94
PID 916 wrote to memory of 6840	916	msedge.exe	94
PID 916 wrote to memory of 2452	916	msedge.exe	95
PID 916 wrote to memory of 2452	916	msedge.exe	95
PID 916 wrote to memory of 396	916	msedge.exe	97
PID 916 wrote to memory of 396	916	msedge.exe	97
PID 916 wrote to memory of 396	916	msedge.exe	97
PID 916 wrote to memory of 260	916	msedge.exe	98
PID 916 wrote to memory of 260	916	msedge.exe	98
PID 916 wrote to memory of 260	916	msedge.exe	98
PID 916 wrote to memory of 1012	916	msedge.exe	99
PID 916 wrote to memory of 1012	916	msedge.exe	99
PID 916 wrote to memory of 3456	916	msedge.exe	100
PID 916 wrote to memory of 3456	916	msedge.exe	100
PID 916 wrote to memory of 1788	916	msedge.exe	102
PID 916 wrote to memory of 5888	916	msedge.exe	106
PID 916 wrote to memory of 3004	916	msedge.exe	107
PID 916 wrote to memory of 1148	916	msedge.exe	108
PID 916 wrote to memory of 4708	916	msedge.exe	109
PID 916 wrote to memory of 4708	916	msedge.exe	109
PID 916 wrote to memory of 6204	916	msedge.exe	111
PID 916 wrote to memory of 6204	916	msedge.exe	111
PID 916 wrote to memory of 5780	916	msedge.exe	112
PID 916 wrote to memory of 5780	916	msedge.exe	112
PID 916 wrote to memory of 6544	916	msedge.exe	113
PID 916 wrote to memory of 3264	916	msedge.exe	114
PID 916 wrote to memory of 3264	916	msedge.exe	114

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v13M-m7-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v13M-m7-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7ffb0c6ec188,0x7ffb0c6ec194,0x7ffb0c6ec1a0
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,3357958829997163886,742592689440375339,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,15029156986337427535,8571418875420073561,262144 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,905078810217192891,7112824221444494192,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,16692439419246174639,9454087438441870798,2097152 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,7927594420336274720,8325889959281643483,2097152 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,14581727407986393044,2313098619167139115,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,1399544297590894888,18375796778518467398,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14833425570704842738,3441696369055455653,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14833425570704842738,3441696369055455653,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,18079594587021201937,2091351718855026230,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,10178790429775668297,4733049488743186877,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,16349898874663597554,5816483388768780796,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,1031887811581318020,4872262579881137865,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,11232570633865646299,3590560073098591084,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,18042304406682696511,7912651197768333468,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,3396499286221569534,3922700278364649785,262144 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1200,i,1714080765420821807,12317306148866303632,524288 --field-trial-handle=2116,i,17839105585108422827,12211039310986897976,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:14
    3⤵
    PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d6bb2e1ef1ec590ce8a90b60e1ec22c12319f1ea84e0b8566180a5cf744fb0b6
MD5 0b1d59c2e49b00246fd9a48206fcbb65
SHA1 fcc1097017c94c5174c59aa7a1e541cea0aa409b
SHA512 14cac8ef15491c38f89d892a18ccac3a88d90f305f29a2ff796ddcde28d82ed23e2e9cf2fcbbe6fe60b1093ae4ebf6798633d3bcb11fe002dda56eed9881883c
TLSH
T1B3E02BD5C920BC675DFC1B2861A45687E750236B3B40880F3B3C816D8FB063B4687C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2107d90906379b99624f5fc03aeae65075fcf872f15edb1842fbbd27544d41a2
MD5 5c7fe5a6bcafa25af2886ee7e6829e6e
SHA1 91f0fc8d83313462689badf354e1c3bba0f9fe03
SHA512 7f323e9ad629a17a5f980c17384b32582eb8d2b313c38b1222c5f0368dee4a0a99adf4b5f4be653202e35ae8b5f2edd014136d9599f58159d290d72cdb48e287
TLSH
T17941AFF783F4856ECA1196F0EA186E2FCE1D0515432C7D9A89E0AE2793E3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 05f512d8c7f9ffeb39ddb9c60d1854ea0561d8234360661a4bf2fe533437b8aa
MD5 8b27b5a0753fbe277b47872fd36546c9
SHA1 b42a2ac3c69306d3f7dd219003ab8cde8fb7c40f
SHA512 1a5916bcd35c8b60104306baed94fa26a6db1b19d23c644e81c354f87eb8f222f6a675386839210c99a2b564ad97d849b45af587f9f363c44950916a7b7e5a1a
SSDEEP 384:sxRVmX8J/fFsKUN/RIgT4/5IW46sGQnj2:sBmsJ/f5eWn/5IW46sGQK
TLSH
T12472EA15AA289D3B8CDBD319FA957F93D2F91173A1905E44AAFCCA0C04E76EC211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 630abacdbde899cc5c5598bcf84a343be4d20120d91b159faa08920b9c6a19d5
MD5 5518dd94c2d2765a0345caf60a2a1a9f
SHA1 b2768f4a2ca2337557851404b68ec9df16347240
SHA512 649505de9064717d88ddec2a2f1422e9edc32bba9b8312be2b8647e156daa026f50e69a0de50c8557db2b2cef7f4ad755f477f88cff077fd198b68b62dec376b
SSDEEP 384:sxRVmXqUJ/fFsIvN/RIgT4/5IW4LsGQnTrp:sBm6UJ/fblWn/5IW4LsGQvp
TLSH
T11472E8159A289D7BCCDBD319FA957F93D2F81173A1905E44AAFC8A0C04E76EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0c80fc4a2ce49abb650f35105d6bebb7118708927c4039831a9a647baa11a03c
MD5 590a11ca8a7a75ea4e594d7a685a0b57
SHA1 49771fbdef24a18f61f7d15d4c2f9fba6e8bd53f
SHA512 cbbae8b11af9a8f47b9631b1e532644ceaad1e711ee0d5e606fd4a93dd9478eb7043faf19b847536f1298a71f21582da40bed2843b653f0505a203046aaae8c7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwobbDwzroQ4a:Ob4YZnE7yTWg1NfwBu1ja/obHwAna
TLSH
T181E2EC3B280CCB7E4F804ADDEC29BD9B6DA801CF5AD8895447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 652f48fcad8014870ace826050b4b5585a2cdf2e7aa1c7dbedc122179e9ea4ad
MD5 8fdce196448c478f49f83e2914476c15
SHA1 0b2b13f0b15e40d963ce5b7b1bcc86f4135be15a
SHA512 a0f8520c74a952f656aff72736cb16b3ad9420dedbcae2fedace447a3f89f0d0e70cc9ca9881ad433ea6d073bfa37106f1d8f611360015fb3d56cea0bdaa2d93
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9TLd:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRo
TLSH
T1CEB24B11713F4690387EA90C91B8981E96C2B4A37419E53F7BA801A65F67E039DFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3c86b1fc2c57c77efab20448d20c2c253134845a66fd8f63c14005f04396cdc5
MD5 c9246d84fb644450e695e91ec4e28ea7
SHA1 e6a402db9d7970f58785d37cd9615345d3a38dcd
SHA512 d7700501eea5c430159a9b22ef6925c96443bbecfafc249c278071076cfe4cbc4398f39ea35c63af30808437b107bec63c23079421828a8c349d5bb6f6efac1e
SSDEEP 384:nIiFiZcIo8NLN8TUNTUlIRHPvuThUvEqf+GGiwbjdsRSTUnsa+VYyFlRa8LEEIzG:TFQoQNwg9uyPGiwyRKYhgJNZR
TLSH
T11BC22A72E858CDB7ECEB8B96B64A7286DEF05163848C9DD8D6D45E0D00971ED070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0d215d182353db0e7fc8ceaf2b08cf0efbfcfd90d429a7fbed6e9ba8fa5cc21e
MD5 9c59ad429d2b03301d13a29a3674a55e
SHA1 492940bb83bbcf1290c238f942af540e93ec5d1f
SHA512 6e90bc2c3ac1d1d8b687087a135101d42cae3b1eb58e6944765920380e1b587a0a7b0baaeda7f5e24b6f2776c584adb597d615d99dc9d1e2b1c52c81fbe33fa7
SSDEEP 384:nXiFiZcIA8NLN8TUNTUlIRHPvuThUvEqf+GGiwbjdsRU3Unsa+VYyFlRa8LEEIzG:SFQAQNwg9uyPGiwyRYYhgJNZR
TLSH
T14EC23A72E898CDB7ECEB8B96B64A7286DEF05163848C9DD8D6D45E0D00971ED070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4e11b2cd79f7333b7ab6b255a4dec2af56a598eab910a2390e51b1b808c62bc0
MD5 11365ed1669ac69b53a9d46c07bdf833
SHA1 16d0d6ad965460b5589a2bbafeeeefa78cbbeffb
SHA512 e1592ff5ff1bd686cedda4e8ddc01dcc163804fb185db7d17a601c6fc7ac1a82ff6818e12e4e20e98bfb30182aeeca08fbf05fedef6ab31f7c352d80e39fad61
SSDEEP 384:nhiFiZcIA8NLN8TUNTUlIRHPvuThUvEqf+GGiwbjdsRU3Unsa+VYyFlRa8LEEIzG:IFQAQNwg9uyPGiwyRYYhgJNZR
TLSH
T10CC23A72E894CDB7ECEB8B96B64A7286DEF05163848C99D8D6D45E0D00971ED070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6421ad980e18d92b003bd40a7f3c12582f46a5631603e37426ba77a9259e2971
MD5 c90e1c9d02cb857684539329acf331fa
SHA1 ed57e0c42b484193e3598e6b2247fb6cb8851e0d
SHA512 e4cd9b7a76a037eb457b536c80a309a37e64ec2d4d16d3711505412890141e3869003fd4dc759f6f9e244b9fd6a1fd76d51a816c0189fe5d22b058f38f36333a
SSDEEP 384:nriF1tNn/s3n9Sn8NgK8TUNTUlIRiPvuTu8REqf+GGiwbjdYLvOObjI9G6w7xN8H:GF1j+9SXKwgUudZGiwkv29M4
TLSH
T14AC25A36E859CEB7EDE64F99B34E7646EFE01163859C69D8EAD85E0C00C31AD0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 040b2001284d8806ad001225c8ee3130fda1b03b1f4b032a28982b8978a4fd9a
MD5 0220db78dbd69a60b45bd055f8f6e0ee
SHA1 c2afab722f750392b16de840bdac46365e310b3e
SHA512 89f90d990ab0578fc0f1cdc782658859edab0cf0dcba60aa0d6126581e13185f92cbcf594460deeebb4d2316f9b459ff1ca6abe9aed0b23801a29dcb4117d4c6
SSDEEP 384:nhiF1tNn/s3n9SG8NLN8TUNTUlIRHPvuT3UvEqf+GGiwbjdsRU3UnXk8LEEIzVGW:IF1j+9HQNwg9uAPGiwyRYYX4
TLSH
T1ACB23A32E865DDB7ECEA4F99B74A7686DEE0116388889DD4E5D85E0D00C71ED0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6cd49ba63fba328d7baff357408d754781d8adc3d0ce00eb5419a12d9c1773eb
MD5 745059315e7cc03aca7e7c4079459c24
SHA1 dadaaf70a99b4b561056f25513623091f626535f
SHA512 c796911518b5d748193b8e114fe26977ac20dfd82d0b485ad453d8bbdfd2339efc130858c9a9697ba5aa1a4ed5bf787c45da84be3487c6d58817d0699e9cd2ff
SSDEEP 384:nSiF1tNn/s3n9Sn8NgN8TUNTUlIRiPvuTN2vEqf+GGiwbjdsRUkUnOObjI9G6w74:ZF1j+9SXNwgUu4PGiwyRtY29M4
TLSH
T1B7C25C32E859CEB7EDE64F95B74E7686EEE01173888C5EC4E6D55D0D00871AD0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download