0db788251d2558d029d2873096b3faebb0d5c8381d23e67b12926fe4032b2751

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wp-content/images/icon/icon-whatsapp.svg
Size 1KB
Sample260910-apb3escj6v
SHA256 0db788251d2558d029d2873096b3faebb0d5c8381d23e67b12926fe4032b2751
MD5 20b4ab5a4777e715525f59915120cc49
SHA1 e2433d4b70dd2c1636c613fe5d8e9c019423ef29
SHA512 c155bebea1e2e02d911e68d27130833473e493df80aa74261a43e449af53b36bf2d362f23644a07010e16996caa2049809ccbc34ca952034d7a8e4b1d5f7e440
TLSH
T1AA21BB59C3550B32ABAE075454D4186435848DCC64E835FCEB2B84A1F46CFF960563AE
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2164	msedge.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_191504444\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_1656997571\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_1656997571\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_1656997571\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_490099095\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_490099095\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_490099095\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_191504444\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_1656997571\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_490099095\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_516628105\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2164_516628105\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7148	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334734400576101"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{3D1E9E8D-7236-487B-B761-A6E748E67B93}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6148	msedge.exe
6148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2164	1932	iexplore.exe	90
PID 2164 wrote to memory of 2284	2164	msedge.exe	91
PID 2164 wrote to memory of 5700	2164	msedge.exe	92
PID 2164 wrote to memory of 7148	2164	msedge.exe	93
PID 2164 wrote to memory of 5700	2164	msedge.exe	92
PID 2164 wrote to memory of 5700	2164	msedge.exe	92
PID 2164 wrote to memory of 5204	2164	msedge.exe	94
PID 2164 wrote to memory of 5204	2164	msedge.exe	94
PID 2164 wrote to memory of 2036	2164	msedge.exe	96
PID 2164 wrote to memory of 2036	2164	msedge.exe	96
PID 2164 wrote to memory of 2036	2164	msedge.exe	96
PID 2164 wrote to memory of 3700	2164	msedge.exe	97
PID 2164 wrote to memory of 3700	2164	msedge.exe	97
PID 2164 wrote to memory of 3700	2164	msedge.exe	97
PID 2164 wrote to memory of 2388	2164	msedge.exe	99
PID 2164 wrote to memory of 3580	2164	msedge.exe	98
PID 2164 wrote to memory of 2388	2164	msedge.exe	99
PID 2164 wrote to memory of 3580	2164	msedge.exe	98
PID 2164 wrote to memory of 4568	2164	msedge.exe	101
PID 2164 wrote to memory of 292	2164	msedge.exe	106
PID 2164 wrote to memory of 2896	2164	msedge.exe	107
PID 2164 wrote to memory of 6504	2164	msedge.exe	108
PID 2164 wrote to memory of 3672	2164	msedge.exe	109
PID 2164 wrote to memory of 3672	2164	msedge.exe	109
PID 2164 wrote to memory of 5772	2164	msedge.exe	112
PID 2164 wrote to memory of 5772	2164	msedge.exe	112
PID 2164 wrote to memory of 2068	2164	msedge.exe	113
PID 2164 wrote to memory of 2068	2164	msedge.exe	113
PID 2164 wrote to memory of 5148	2164	msedge.exe	114
PID 2164 wrote to memory of 5148	2164	msedge.exe	114
PID 2164 wrote to memory of 6148	2164	msedge.exe	115
PID 2164 wrote to memory of 5256	2164	msedge.exe	116
PID 2164 wrote to memory of 5256	2164	msedge.exe	116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\wp-content\images\icon\icon-whatsapp.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/wp-content/images/icon/icon-whatsapp.svg"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa5e2bc188,0x7ffa5e2bc194,0x7ffa5e2bc1a0
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,8762520733781018640,315837523377633573,262144 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,5335592001036197487,17132460525191625546,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
    3⤵
    - System Time Discovery
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,7586214717147367726,5405939486784084898,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,6574553883706709032,2428137234573943283,2097152 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16525589712252481849,330197829621428121,2097152 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,15468314020489084218,8910330178611367906,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,7787755269790981822,11725651693073757035,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,11829990420290834439,8134255807033288329,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,11829990420290834439,8134255807033288329,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3067612931137794096,6570100595392553716,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11994585625081862703,16035679718911032095,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,5412513460235110957,18265575435187032589,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:6504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,5046210124757314762,2900188321433634586,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,17660315128773892280,11927138019576530113,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2832,i,4554825593294525939,12577662648776872848,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:14
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,4310253372073400626,15486554127686842684,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,836463689946180150,17555467053966963460,262144 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,12107353784372130908,9567459821859505822,524288 --field-trial-handle=2328,i,17449467213997404056,7279549593766451577,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ff9afee956c77f71a2e27a409d8bceee71ace43f4770ba977b2d55ec44c6f00b
MD5 689c728973fed075b839d65d8bef7510
SHA1 a8bb3812d7a10ec45a37f4df445f9098195cbec6
SHA512 b79d0741433e4967fa69aa9845875802ce0301c293cac089829d734d9e5d6657ef8563e6db598943299d61c75fba815568c9da6f9310fca9d6bae7e218aa4c28
TLSH
T115E0E569C921AC2719FC1B186054064AE740132B3B41880B3A3C822E8FB067B438685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

9d1d4543-d63c-48f9-bcb7-81d7de68a203.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d1d4543-d63c-48f9-bcb7-81d7de68a203.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f04a1d4eaf773838b3024238074b73699520a0a237f76eca08189f986bafde39
MD5 66e0a82ed8ce292d6d8b343939a5aa39
SHA1 52d958ced9a11dec4ea4e9e6882fb48162c63bd1
SHA512 3fb028c23b2c32c5fc403e76c82ba6c68eda2841dba4727eca955b14a7b21cb0c3f2c75b1934b0d4f8c82889d7a42af16e18e61e711b4f1e13c7feae48967034
TLSH
T112419FF783F4866E9A1196F0AA18BE1FCE1D0511432C7D9A85E0AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6dc8c21dea248825a3f4a13929f67c3835be682d2541add3fa22b506427b1b53
MD5 fde69a1226bc793e57fdce9859e5ed07
SHA1 72e4f187811c00d5412b24d0432f78c984cfe303
SHA512 6476c77d5c3904b1135ae2dbf17cad5af65b25c958f31b80863c7abfa24daa0e4d1b2cceeceefebff2c09f7d0e548964830416ad653c1854d6b5b7d85f35c451
SSDEEP 384:sxRhK87/fisj7N/RIPsi/5IW4AsGQgHSujn:sNH7/fhxWt/5IW4AsGQgHSo
TLSH
T15272D815AA249D7BCCDBD309FA957F93D2F91173A1905E44AAFCCA1C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ca8086e6a13f15545badc4d04bdca1b84d5dbeba66fe858fb4d3a41f0f415016
MD5 cf797774d37306505ea2925ffc15c49f
SHA1 97b343f378f206f9e60f1a76716141fa2f626285
SHA512 c4f3d75add3cad77c5f4926cba6b204cc163099e4901fc3e409a0b109255cee97ae446196ed426f67043db0d48114fc7aa793dec4f90ad360891dc4c970386b5
SSDEEP 384:sxRhKqP7/fis0oN/RIPsi/5IW4hsGQgHSueE:sN1P7/fqyWt/5IW4hsGQgHS0
TLSH
T13D72E815A9249D77CCDBD719FA957F93D2F81173A1505E44AAFCCA1C00EA6ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f8828f9fa50acc36fb4834c7b84b563ec5789ae25f493a074ba934b54d5746e6
MD5 064fd1059c7388ae233637c85232be87
SHA1 34a3f6946d311095d998bf9f140bddb54f6aa0ca
SHA512 3b30971e3dcd4834a4aaa29887d979ba9a7ae28994e7f3e0ca90a4cdc609dcf2048df096ae1c692132055b98e621a0af3d8d173bd2e881beca5dd55d759db142
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjjobbDwzro34E:Ob4YZnE7yTWg1NfwBu1jaUjobHwAIE
TLSH
T17AE2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF96D8895447FA450C03C6BFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b9cc95571dcd44154e5db9a1df20b4d696ef9b3c509f78f3a0231cca31b49386
MD5 72663cff992dd844c9ecd23f26fc50d4
SHA1 d21fe45e7d54f929d77bc4fb8131d17c88e7f052
SHA512 30b334ca6f83cec20fb87df248e874950699f9649d43708c908f3d82f97591ac422fa19397c5ab77fc48b0282b978b27cc5defcf4ae3cf7068312cba5b4a7afb
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9fjV:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRY
TLSH
T117B26E11713F4680387EB90C9179982F92C2B4637419E57F7BA802A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bbaf1a2ad3450b2fcb4b6a347c3ba5a8fb812dd07d06fef843e2299d05c834a9
MD5 e352f0514a99d3476aabae34afedc3e4
SHA1 52820e9388d892794ede0eac474c2b7ffee9bf02
SHA512 031c80a226de64354f7bf7763fc27dd5dd3f16559b5376a1162681d924477461580237fb14637df503c40a55c21f335d1726804cee7c6b638652e8bdaaabc991
SSDEEP 384:n4iF1tNn/s3n9Sn8Ng28TUNTUlIRiPvuTuGREqfbzGJKmOXpz878J8LmLOObjI9y:DF1j+9SX2wgUu1XGiZAQJa829Mt
TLSH
T1A9C26B32E855CEB7EDE64F98B74A7656EEE0126385DC1AD8D6D86E0C00C71DD0707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ea811d3f1ed7371a2ae2414bf9436c023b1432a9164f1c7b734cd1c13b01e2b2
MD5 aaaac8d37f2528419c7d390d0b07ae49
SHA1 7acc885ca18bcfdb3dbc9f9924b43920162c97bb
SHA512 6804996057cc847254447472f2376a45c8ec56e9b95977a474d7f7cf14a8d82321ecf90ec98f2fb31c751dcf711835d4b3e8904fd3984810de175059f4d4335b
SSDEEP 384:nCiFiZcID8NLC8TUNTUlIRCDPvuTperuEqfbzGJKmOXpz878JKfL3l+xuvzxV+ME:JFQDQCwg0uwQGiZAQJKZ+4184pEuW
TLSH
T1D0C25C72E895CDB7ECEA8B85BB4A7243EEF4516384CC9AD4E5D55E0D00872DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a8f30b1bff5135dffa9047613ad7ac3e7c50d0c9ee851d7363a4d9640fe744fe
MD5 0cee2ed6cee6dc0f998dbcf7a1a10715
SHA1 c49915b29e59a3292976b490f6f6ca1ccdea58d4
SHA512 8f312d9822175f8e145e692784389979504e01800891315d28feeb5a2d33078b40693b5a84c8eb6043b22e5dd684376b0b5ecd3c7bacc3f99e5d9f79785fd3d0
SSDEEP 384:npiF1tNn/s3n9Sn8NgC8TUNTUlIRiPvuTB6ruEqfbzGJKmOXpz878JKfL3k+OObh:AF1j+9SXCwgUuYQGiZAQJKw+29Mt
TLSH
T1C0D25C32E855CEB7EDEA4F98B74A3696EEE05263848C5ED8E6C95E0C00C719D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4090b7f02daf708c0384884c262b170cea8063a56848bb3be8765b78086ae631
MD5 22004447cabad3244f64a44f4743f0bb
SHA1 dec26a8734df23662525e0e179b85b4288e698bd
SHA512 6c50bcf08a04162164e3ec33d762e09606cd3c0f5e297a12ccb5e3807149ae690b5bec438d79546d40a0fb2e3c3ff2d2995064ebe597026e34e846814de6f41d
SSDEEP 384:n+iF1tNn/s3n9SB8NLC8TUNTUlIRHPvuTperuEqfbzGJKmOXpz878JKfL3k+h8LR:VF1j+9AQCwg1uAQGiZAQJKw+G
TLSH
T11FB24B32D855CEB7ECEA4F98B74A7646EEE0126384CC5AD8E5D95E0D00C72DD074BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2c1c8842e9583afaa8c8706ba5e9e2ac12461ee31a498d2a0d301d26fb6a219c
MD5 2a3d9f2ca0ae37130037e83374f71f7f
SHA1 fa000815ce203784b2c87d7b3184324c0f443bae
SHA512 d1cecaeeb7819ab0976fb206e9bbc0a89d0568029bb53bcf7a057ab8a97c0828750909deb14924ff9de00c5e4a5f17331f5025048661a30b428bfe03a2961e2d
SSDEEP 384:n+iFiZcID8NLC8TUNTUlIRCDPvuTperuEqfbzGJKmOXpz878JKfL3l+xuvzxV+ME:VFQDQCwg0uwQGiZAQJKZ+4184pEuW
TLSH
T16EC25C72E895CDB7ECEA8B85BB4A7243EEF4516384CC9AD4E5D55E0D00872DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0a3b220be4943a1cdb16c9bc39cde9323607e0fbeee01cf8d4919374b2354c89
MD5 592253309c73557f217275cb3e4a65bf
SHA1 980c950ae290aa8d664debf7ab56a6a170ae51a2
SHA512 fe273750fe66f1d809570c5d40f83b63679ba22541ebef940cb841d1b8639431c6b8a52c3253e8b946af0f57dba0b2cd6f9297e8c297b579e3fb0a520e902b14
SSDEEP 384:n/iFiZcIF8NLC8TUNTUlIRCDPvuTperuEqfbzGJKmOXpz878JKfLvEB+xuvzxV+j:KFQFQCwg0uwQGiZAQJK6+4184pEuW
TLSH
T1ACC24C72E895CDB7ECEA8B85BB497243EEF4516388CC9AD4E5D55E0D00872DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c51ba821bf356132d1b7cd4b592cf9c755f7357bf634240dc4df69ef0f699ce5
MD5 eb56e0946f920f37434482d6a27e02e3
SHA1 bdfb4b4a63e6eecd30115d237593cbf05ee86135
SHA512 889497252ba5b465a6c32f6c8f6d7bcc10eb7382294b0233b5940781cb135ac1726187f4142fd174612a5dd98d10e7e360fac7b98ed1c922bceb4caece06d6cc
TLSH
T1215150E04C3C16D5D5FD0E3EB05739FC85EC8726B8A034386858EA985A3A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 227be09e96c4832820afaacf9d6ad4e465a70ffb9ad647e7506b01eaabc2ba29
MD5 6b31e16abed878ec8f83c2d26611117b
SHA1 708191624e1213c3f87e073e478169f0b74f0514
SHA512 beea38815a8328c54cdd63c2e77537c64fdf3a5fa3ef4fce943c978f9b4ffac236a333b5ece11ffc02821ac21421ffec15a7eff5e2b5771e1ac768c33789b00d
TLSH
T159514FE04C3C1AD5D5FD0E7EB05739FC85EC9726B89034386858EA985A3A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download