1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v13M-m7-eL.svg
Size 35KB
Sample260813-24kfwszvbv
SHA256 1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388
MD5 bfd57f9c04b8bfc4e5434bae690e2203
SHA1 e7b3435c094295274f0af2f8397f5bb45ea184c1
SHA512 6758b4a12d192d174ef164e40e6e9404b61b978a9fb28913f7bf0882d22b005217c3f048344f661fc2e264b7060e3cbe73503e4b546688f5342e8ae0eff3613b
SSDEEP 384:chMBVd+SOAKzMf2qACRnJPB/nafePgDOx48FAIddEIRisu:c2VdxlZdIV
TLSH
T19EF2306537F43C9B8BCC03479D42FC6C46AF98B78098678D97D790E8A548368F7AC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_653383011\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3784	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311360981213217"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{8B71AF6F-D98C-48DF-B37C-5E39F840C3EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
940	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 940	5000	iexplore.exe	89
PID 940 wrote to memory of 2372	940	msedge.exe	90
PID 940 wrote to memory of 1532	940	msedge.exe	91
PID 940 wrote to memory of 3784	940	msedge.exe	92
PID 940 wrote to memory of 1532	940	msedge.exe	91
PID 940 wrote to memory of 1532	940	msedge.exe	91
PID 940 wrote to memory of 4284	940	msedge.exe	93
PID 940 wrote to memory of 4284	940	msedge.exe	93
PID 940 wrote to memory of 3536	940	msedge.exe	95
PID 940 wrote to memory of 3536	940	msedge.exe	95
PID 940 wrote to memory of 3536	940	msedge.exe	95
PID 940 wrote to memory of 1072	940	msedge.exe	96
PID 940 wrote to memory of 1072	940	msedge.exe	96
PID 940 wrote to memory of 1072	940	msedge.exe	96
PID 940 wrote to memory of 6124	940	msedge.exe	98
PID 940 wrote to memory of 2692	940	msedge.exe	97
PID 940 wrote to memory of 6124	940	msedge.exe	98
PID 940 wrote to memory of 6124	940	msedge.exe	98
PID 940 wrote to memory of 2692	940	msedge.exe	97
PID 940 wrote to memory of 2692	940	msedge.exe	97
PID 940 wrote to memory of 4660	940	msedge.exe	99
PID 940 wrote to memory of 4660	940	msedge.exe	99
PID 940 wrote to memory of 3528	940	msedge.exe	102
PID 940 wrote to memory of 4380	940	msedge.exe	101
PID 940 wrote to memory of 3528	940	msedge.exe	102
PID 940 wrote to memory of 4380	940	msedge.exe	101
PID 940 wrote to memory of 3028	940	msedge.exe	104
PID 940 wrote to memory of 2812	940	msedge.exe	105
PID 940 wrote to memory of 2812	940	msedge.exe	105
PID 940 wrote to memory of 4520	940	msedge.exe	106
PID 940 wrote to memory of 4520	940	msedge.exe	106
PID 940 wrote to memory of 4980	940	msedge.exe	110
PID 940 wrote to memory of 4312	940	msedge.exe	111
PID 940 wrote to memory of 5816	940	msedge.exe	112
PID 940 wrote to memory of 1792	940	msedge.exe	113
PID 940 wrote to memory of 1792	940	msedge.exe	113
PID 940 wrote to memory of 2924	940	msedge.exe	117
PID 940 wrote to memory of 2924	940	msedge.exe	117
PID 940 wrote to memory of 3728	940	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v13M-m7-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v13M-m7-eL.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffc7c23c188,0x7ffc7c23c194,0x7ffc7c23c1a0
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17098423089206824802,13085429945752528635,262144 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,16327740529493329200,17120984027073525851,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,11922767929714717612,9231595396811492158,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,14800970392421528304,17249901384025471313,2097152 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,15737137363400980402,2732857440747614576,2097152 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,7899929096853460279,926928606691566942,2097152 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,5167586739078176959,13983331714014052323,2097152 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,6748001071159899978,15150968863854899905,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,5827904984313621508,4940605903280757330,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,17867536331304021899,1447463717177320214,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,3660314737967305642,6344850046231705913,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,3660314737967305642,6344850046231705913,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,399782067115014047,8703108608527438981,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,6050213257448240297,15967520603450669464,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,6230405970541678645,17029868222026814507,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,12701867476762488057,5234397977609589923,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,2733388859765490484,70764660279992528,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,17578551753810311026,9357923801716478077,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,3710923115966640798,4732225153943144911,524288 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=908 /prefetch:14
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5808,i,4832013839910700895,1895802129238889765,262144 --field-trial-handle=2284,i,6481423672790573681,5226207817165311867,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 30429a0ed5d5653506c9f36a22f1fd50338a94556fe2d4299c7c68953a36545d
MD5 3de3849270b71bbe69ec8f9c726ac781
SHA1 6382ce525b58e978b09b87565c68ba0f43a85b35
SHA512 1e7d0de4c8307e4e3a61aa84e480503b312a606cffda509f5af0cdf31b60d503945df9ee9e1d93cae12e9f37323c262f348ddc25e4eeef67ba8be6586dfa892f
TLSH
T10D5141C7132659E9E72089BFEAE2645A72F5A4655E0F2E0028BCDFB45D02F21D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596325.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596325.TMP
Size 2KB
SHA256 51b869fcadce2dff7be2a106db11c59ae5f3a3bc2c847ea84df1b269bff095ff
MD5 206b159b8d5038fd442d2c1d36c11b37
SHA1 6d9a0641cb7e3fdf3e75cc85e7aa559fe5cc6168
SHA512 4444eebe901b72b4a39019615ce1afa2f7be1a66653f40ab3bdd0e66d8ff23a93a73b348de679697e64a8aca92c4a3b7dfb7077bc3841b89600b6d1b3f636cc5
TLSH
T1AC5141C7132659E8E76089BFDAE2645A72F5A4655E0F2E1018BCDFB45D02F11D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e253334e7d90375d5ae2fde1e473303ad1645b84e5f20e9d5fc8b7b90c1b7be9
MD5 cbeb151d114416be142282974065e364
SHA1 c00cffb4ea43c2aa85441c8a2969535ac3c93631
SHA512 eae68a94409f56f834605aae79ff0e4dba010c2ad38b20a8919d6720ca6335f9a715e1c37a59a0c5108bf38409525fa539242c719687aa64a38c1baa6e5aa810
TLSH
T17B418EF383F4857E8A1196F0AA14AE1BCE1D0515832C7D6AC9E4AF2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 780fc193f08d7b84b09821cad403ad3586345097dc88af0fcab46517a01b8fb9
MD5 70fe721e6392916512f0b0aa64c13adf
SHA1 aa45401491aa61bbff6127af02846491be91d96d
SHA512 f4f5c37dbad7d6790e4193bd4b9bc03518b1e3e142eea7bc30bb39fc0fbf0a0b4dd03fa1021058060f99477732cf5531233542cb9224daa7dad5d2381478a656
SSDEEP 192:sxRaRHCo/fvs8ihZZVHCOzoA8p4o/g6+WNIYE5G30GMXIgDi6J:sxRaso/fvs8ivLHKF/5I8MZ
TLSH
T10342D9166E28AD3B5CCBE21DBB567F53D7F95072A1901E48BAFC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 179229430e9114df8f8ea86ca80f4f92e970abb90de142c5502af8ddb0df7e10
MD5 528663e6ea69a354a14b60aa59d2b531
SHA1 666a3059264e19837678a2e2275d36159a5df1b1
SHA512 680e69bb184c2e6a2ef4bf043b48ad9826550f9eb874834361ea885c04fcda0b450b8fbd5af4d24c49a1a1fdda55030c792a5820f214a519444a058127d1cc32
SSDEEP 192:sxR5RHCo/fvssfhZZVHCOzoA8p4o/g6+WNIYEg430GMXIgV6J:sxR5so/fvssfvLHKF/5INMw
TLSH
T13B32C8166E28A93B5CCBE21DFB567F53D7F95032A1901E48BAFC861C14EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 20e1ed3e50a340de0509d3da98ab89d368f3073dfcfd226b1181580d7ca95272
MD5 60d0e9b0875638ef9b14079c8b9a796c
SHA1 1bbc61bd71c3a634605df3d0371a228658f12089
SHA512 a3f9539f90a02215161369cd2c678f3d1ddb43b74fcf7748e8a56ff18e294d8726677828feedb146349f1d33d61ac984a35a72a8686436122c4edeae7c678563
SSDEEP 192:sxRaRHCo/fvs8fhZZVHCOzoA8p4o/g6+WNIYEg430GMXIgDQ6J:sxRaso/fvs8fvLHKF/5INM7
TLSH
T1C042C9166E28A93B5CCBE21DFB567F53D7F95072A1901E48BAFC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 51f5dbc063e1be6a7fdf8c39864823fa6c7730436d1b2350a24eb35b68dedfcf
MD5 fae2815f5fa4d6051b272eac74a55811
SHA1 de27aba2fddf9aea5a30a0403a8cf58af3c43c2b
SHA512 e4d1467994a17520470a532e72b654af41bb5cecfca02c62cb5cdb2c112491c3a021660bd15e9bd9b4de40f565f00fa645186262b470872549fe07271b885173
SSDEEP 768:40Dk6DJQD8RF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+g:40Dk6DJQD8RTE7N0DbWgQ6DjfIQDFu1j
TLSH
T13CD2EA7B640CCA7F4F804ADDAD197ADE6DA802CB96D8C98047FE981C02C7BEE51154DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d47ebc3b2817504a317f1709b06dc8e6359679419807bf491c9f99b3e7362633
MD5 761b5c4f783f2d8fa104fa1a7faa5277
SHA1 322cf5812c5de04a7a1e29ef1d791adf66ab381b
SHA512 4b8f5da8d7decced557fccac15da09f7d3f94c3046c26b0ff4de426f04fc1f75f34e87b6e80214a9cd01cf10c767a86c50f2f385b3cad63a8a70e305e2bba6a1
SSDEEP 96:KRjsJ9rhhdW1aQgldK4cgLdczLiVhmHhevL5bfrWvsagzrK4Sg9rchJEX+HKKswn:CjsJ9rhhY1ahl3cgLyzLiVhmHhevL5bs
TLSH
T115913100757A12403C7F7A0D98ED992F56827972311AB46F3BA812A30FE6E434DFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65445a14-1182-45b7-8f3e-7b606d25c855.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65445a14-1182-45b7-8f3e-7b606d25c855.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e2dde3ba3ccdd09177f48694ce0eadeced9fddefeabcafef3f37dde8b83c0a00
MD5 50d924e7c8bf4cbd850c75495666d481
SHA1 fc07ff1b85e9ebecf26513f1e7679181ea80f4bc
SHA512 2d7c1d1ac3d3b7cbbc763026517b15ec2a7a749077a875481ff17557382ae85956671205f993492d4ffbdc19e79869f4a93b09a7dabc4ab3524209fbee023467
SSDEEP 768:bFQV3VwgjCTLDJMzZZsnUZMceX6+qTko0u229a4vsToPi9P3:uV3HWUZMrvVTVKa4tPU
TLSH
T13403AE72ECA589779DFADBC4B25B3283AEF511B3C4D45A84EADC990C154315C170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5418d16bebe8f9c5170a5dc59467bccd0d4ac1b1cbeaa0ebba7105a319c824e7
MD5 408d3f62946d0c2816e4a15d0d01fec6
SHA1 3bb973a9db3936558d5487103dd536b416b41717
SHA512 3952f909180b9e276b4048b019a594a15f0584443b8fa920984cec245f248db1816f19c2ac445f21fce01dad03adf4e1eac0cbb01720db2f070bad5a3e3e5262
SSDEEP 768:prv+4UNbdG3ZvnYDTd+ZsnUGeX6+qTko0u229a4vsDLeVH1SdW:pbsbU3ZVWU1vVTVKa4eEH1h
TLSH
T1F603CF33E86589778DE697C4724B35473EB91163CA880B90D9ED6B0D029B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 45ac98f5e4308d2f7fe75bc9cc4726e2b9c2cd68a903387ae1905a5f092c596a
MD5 40d8b3fb935ea3cbbd6be6bf3b2cd2e6
SHA1 25fb4338c34f09f664469f60aaf46ac4bef21d05
SHA512 4bcf039d96071003360c03e0732f4ff0e46647df708fa9957c573fbfc40a20f6dce37c4d657152cc9c5158db0cf4f51a87d6a54c4bed4f4541f0deaa37460393
SSDEEP 768:Orv+4UNbdG3HMRDTd+ZsnUZMgeX6+qTko0u229a4vsSoeVH1SdW:ObsbU3rWUZMPvVTVKa42EH1h
TLSH
T1FA03BF32E8698D334DE6D684714B36872FB921B389C40B94D9EDAA4D054B59C270FD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6c207c4945e73ece5c518666ab9e939254099408815f976da049139066d8683f
MD5 6b760dc740ef825b933422f5540f1935
SHA1 0792e109dfaff26f04b6bea95a006aa1952778ca
SHA512 f715dd2be5c6a536bc687b9d7890f8fd0121bfdf823c04c0b1a993760f98ed4c3ceb9a45e35077c5742ea04f967ac7ec758d7aa9b3a4c0a86944fc7668923d21
SSDEEP 768:c+3dCPDTd+ZsnUZMDeX6+qTko0u229a4vsToPi9P3:c+3ZWUZMCvVTVKa4tPU
TLSH
T10EF2BF71F8768D6349FAE784B25726876EB911B3D5C81A84A9ECE60D054722C270FC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b559b466aab6969f978c3f617b7ba313cd301b66539c74ace270c2a0445cdd7a
MD5 e23368d4010528205c9eb4cc3e5b1b98
SHA1 5e1ef9c79b0cc9cf983b9deddb110a08293ea35f
SHA512 2808146eb8553c70dc68701c1f492039087ba5eb97fe6bb1f93bcc04ad927eb877375b8816404c9390c7b097c2c2532f3c7eca8b817a6871ff7f470fcf62b62f
SSDEEP 768:8+38jPDTd+ZsnUZMDeX6+qTko0u229a4vsToPi9P3:8+3NWUZMCvVTVKa4tPU
TLSH
T117F2BF71F8768D6349FAE784B25726876EB911B3D5C81B84A9ECE60D054722C270FC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir940_224308524\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download