d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v10J-m4-eM.svg
Size 24KB
Sample260814-d78e5afa39
SHA256 d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc
MD5 8c786d4da80ac1948a137a727a12fd7e
SHA1 0fb0844fb479811339f7104eb281a91b930ca91d
SHA512 838d9d0ec608d1e47dd3722b8ccd401e03eb334982cd433a7f896e66b62a9e69b9d2d3e8209914dd8563af8734ee368742a979b7e861efd480707c961c193a0e
SSDEEP 384:c5veJtU7WSADG+2tM8LSB7XXZwuw5wE1/7PRP3uDCr:c5vQjqZmDK
TLSH
T11FB21F6437F87C978BD803479D02FC68461FA877C4A8678D93D7D4E8A988368FB6C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4764	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311524187971499"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{F55EFB27-2A39-4357-B55C-D6C0BA0B05CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2828	1464	iexplore.exe	88
PID 2828 wrote to memory of 4912	2828	msedge.exe	89
PID 2828 wrote to memory of 4204	2828	msedge.exe	91
PID 2828 wrote to memory of 4764	2828	msedge.exe	92
PID 2828 wrote to memory of 4204	2828	msedge.exe	91
PID 2828 wrote to memory of 4204	2828	msedge.exe	91
PID 2828 wrote to memory of 5440	2828	msedge.exe	94
PID 2828 wrote to memory of 5440	2828	msedge.exe	94
PID 2828 wrote to memory of 5440	2828	msedge.exe	94
PID 2828 wrote to memory of 4940	2828	msedge.exe	95
PID 2828 wrote to memory of 4940	2828	msedge.exe	95
PID 2828 wrote to memory of 4940	2828	msedge.exe	95
PID 2828 wrote to memory of 5524	2828	msedge.exe	93
PID 2828 wrote to memory of 5524	2828	msedge.exe	93
PID 2828 wrote to memory of 3584	2828	msedge.exe	96
PID 2828 wrote to memory of 3584	2828	msedge.exe	96
PID 2828 wrote to memory of 3584	2828	msedge.exe	96
PID 2828 wrote to memory of 1116	2828	msedge.exe	97
PID 2828 wrote to memory of 1116	2828	msedge.exe	97
PID 2828 wrote to memory of 1116	2828	msedge.exe	97
PID 2828 wrote to memory of 5416	2828	msedge.exe	98
PID 2828 wrote to memory of 5416	2828	msedge.exe	98
PID 2828 wrote to memory of 2144	2828	msedge.exe	100
PID 2828 wrote to memory of 4312	2828	msedge.exe	101
PID 2828 wrote to memory of 2144	2828	msedge.exe	100
PID 2828 wrote to memory of 4312	2828	msedge.exe	101
PID 2828 wrote to memory of 3568	2828	msedge.exe	103
PID 2828 wrote to memory of 1740	2828	msedge.exe	104
PID 2828 wrote to memory of 1740	2828	msedge.exe	104
PID 2828 wrote to memory of 1184	2828	msedge.exe	107
PID 2828 wrote to memory of 1184	2828	msedge.exe	107
PID 2828 wrote to memory of 1508	2828	msedge.exe	110
PID 2828 wrote to memory of 2732	2828	msedge.exe	111
PID 2828 wrote to memory of 2836	2828	msedge.exe	112
PID 2828 wrote to memory of 3092	2828	msedge.exe	113
PID 2828 wrote to memory of 3092	2828	msedge.exe	113
PID 2828 wrote to memory of 796	2828	msedge.exe	115
PID 2828 wrote to memory of 796	2828	msedge.exe	115
PID 2828 wrote to memory of 2164	2828	msedge.exe	116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v10J-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v10J-m4-eM.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffbafd0c188,0x7ffbafd0c194,0x7ffbafd0c1a0
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2000,i,16539681563163535763,13574547119049414404,262144 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,16589094444892824203,13719164167440848419,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8842690856249332878,7624262276259573821,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2467011949329901720,5539623256391312599,2097152 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6630906925024187206,17480008161001718670,2097152 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,13349653738815314993,7047752859577314724,2097152 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,8854697165959931172,2377673947476913772,2097152 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,9639832775491757745,302767899413918230,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,6568985421011129666,3703693090213144189,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,16553725300890114719,13860160424180946451,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5457549949745223174,6806646663909405888,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5457549949745223174,6806646663909405888,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4291972180352967486,4638108536275409917,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,6272443903684502799,17879176636179791970,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,4426268846875722314,16370464146736619330,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:14
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,4504443776689484685,18281096324529886403,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,15825064373206140256,11662360795627767620,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,9803021462191603589,1430342261363261788,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,2410834180486884241,3886745270978495091,524288 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5868,i,5834705824538420570,13272435007460862590,262144 --field-trial-handle=2528,i,3214403902748402695,10629382844813567807,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 58617fca628e5a578d32298110d46c37ada988ac359fe2943368ed0b1d52a6f1
MD5 e5c678e13246ba9a2e0993c12a30d868
SHA1 9ee4643c74930c818f33abcb391db82ee5c05222
SHA512 0a904f73269c1f2dabdfde3ff708d990f58a8b547fdb6b5d7806459c5684406bfeeec81531c3432d1a2e20a4a39fe34e3f620753a0eeddce480a05bdad5482de
TLSH
T1EB51524683F996EDD775E2B512E286B43EF6BC3A83031E12A058EE33890AF1B50D0017
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2210.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2210.TMP
Size 2KB
SHA256 30cbe990a3b7a6119f621f608fb72a4bccc77d9417500c269112c3daa23483e4
MD5 aea3e412ff6e8679a08f216e8b83b2c7
SHA1 0fd671793d7fc7bf0633ed33943987966913169e
SHA512 252df0db82947f74cac85521fb0415c3a105cacbc4c49787cbbccce2546929d8a1c5309b6cfd127412d427717e668d9472773ac4fd395706f5091ea79914ab89
TLSH
T13F51654643F996EDD775E2B152E286B53EF6BC7983031E12A058ED33490EF1B50D0017
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8e13175b734576cc0be2ac91e2cbb7b9550ffabb193ac7f46321f0f212a47ebe
MD5 83e1ec36d41583425986972509f08e49
SHA1 6d18745ab9a92924cb517ac6b363e567801e2e2d
SHA512 817cdbd68d5de629147a7ca4d5fa110258882d907d009d744a387e192d30fbb539b6a96282fe1a19180137b559789dbf100f94962fd9d551bf40050c1c7fecdf
TLSH
T11241C0F383F4857E8A0195F0BA146E1FDE1D0515432C7CAAC9E0AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 64481c3b2792d16899a69a14645e2e32c0a52614a22873b7bad383d8cb59f3a6
MD5 3a02530aa2ed731ae43c21454cb0bbb4
SHA1 ee2dc4717fe935c6364f9946c0f7487686335143
SHA512 3c5cb00a0173b7ffebcdd7b23f4dcee1a1b6d4c227becd8cbf4ddc728e83d4bbbbf185153fc23a2f5e5344f41b0eef5414f58731f89fe23d2a38f55e35fb8f96
SSDEEP 192:sxRoRuCj/fAsvyE1GZ/4AzoA8p4+/g6+WNIYZFLKSLGcIgVFJ:sxRovj/fAsvyE1w/4X/5ISfN
TLSH
T17232B8166E28A97B4CC7E21DBB55BF53D3F95072A0D51E48AAFC961C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 18a266a06743d6462252e23754ecea72f7f08ce46e5c2d4c317bbe1268f5a1ca
MD5 52018aa4ae6e953ae65cfc86d064e405
SHA1 2ee5a91092f913496fabe91338eaa95675d21742
SHA512 02d80b2538acb188c9c4eec17f7e8efeac1d0ae3c2cb5208cd16748da7d9f85e7bd5458b075350cb11b74fa944d4a302e8fa0cdab829e69f770fee52849610e7
SSDEEP 192:sxR7RuCj/fAsqyE1GZ/4AzoA8p4+/g6+WNIYZFLKSLGcIgDMFJ:sxR7vj/fAsqyE1w/4X/5ISfa
TLSH
T19042B8166E28A97B4CC7E21DFB55BF53D3F95072A0D51E48AAFC961C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5e583f5e70e96905440ffd943a4726dd89bf2577b6db3886aee1002facda45be
MD5 6b918f6c0909a041933aace8fbb739d1
SHA1 c76f1933d47b3019268fd1d9a0cc4969bc155309
SHA512 681827e483c38ce74ad7f12ab94ac55200d539b734c52fabebbdbcd9a0ec7acf8809ed62dfac4fdfe917b81c1886c97158474d54d4b67ccb0792b08d9be24eec
SSDEEP 192:sxR7RuCj/fAsqyEBGZ/4AzoA8p4+/g6+WNIYZFL0ELGcIgD+FJ:sxR7vj/fAsqyEBw/4X/5ISFE
TLSH
T15042B9167D28A97B4CC7E21DBB55BF53D3F95072A0D51E48AAFC9A1C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0f9f0d07e852e69b91ae83ffbafbed9761d8c58ce9f2df9266e01a85e637c458
MD5 b74a5b0474d8e156a8378ee5b95418d8
SHA1 b8cc00f8630b0025916e28ca57cfb13b4e63e880
SHA512 5f8702abdf06f64cabf95428c3215db6b30ef89c847fc68760ca50cc7a305185ace917c69a472d610f11b74fe46ef3024e31d793131c4cee265cc10b285cc7d8
SSDEEP 768:K80Ef67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmbowLW2roLH0OU:K80EfSE7FwWgNhfVNu1jaNbogWNLH0OU
TLSH
T1C5D2D87B740DCA7E4F804ADDAC197E9B6DA802CB96D8C98047FE841C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7824eacc-901e-4280-904f-ae35d8fbd6ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7824eacc-901e-4280-904f-ae35d8fbd6ed.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c8b015a23959ab89ffb1083a01dd2f01be696000bd80e6cdbc39929ccb3a4502
MD5 617f7685af2c5fc7e1de2e18c9651e6c
SHA1 bb973ff773af1fd2aeeb9054a767a0844d37cb35
SHA512 f3bd5a5ea68e481cd3830930e30ee0a07b3f2ae3995d99129616fca9e8a4f9ad7911d87e3b1ef3e6823a1135600474d89e49c5bf01263af6404a1dc122bee709
SSDEEP 768:Y/3MX4+LeSFOUKVtpX4fouOToPvB2thtA9VAgXPi9PMtwm:Y/3M4snnwthttWPPtwm
TLSH
T1FEF2C071F8A88D63DCE9E39872063786AFF010A394D41B94DEDD9B1D0547A9E070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 223fa538d36786d4920290aead06b29da7fb39946732d68f61171670f23610b3
MD5 791ae779e6d551f6d7e2642f49683be3
SHA1 c0c0a3f2a33e7c193c4c3613bd84bf5ee6ced0fa
SHA512 86923b8246372b13d20582081da80ee404edd4c18382c82fead523b050336be4ebf811cf277806e2a771cdfc67c922ed2dbd3582d845d14635bad302036fb34c
SSDEEP 768:K/31X4+LeSFOUKVtpX4fouOToPvB2thtA9VAgXPi9PMtwm:K/314snnwthttWPPtwm
TLSH
T1BEF2C171F8A88D63DCE9E39872063787AFF010A394D41B94DEDD9B1D0547A9E070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 41f156f392a2e38d55805aad722cb9b0ed0e1c761960280773e4e16174b4b0f3
MD5 b528224a5e0d65eed03d398ba20290a0
SHA1 bd81df9f7e445a5508dc928832f9280f076ddf73
SHA512 ab374d8df0b333e4572f403095cd80e8913350ddfee8f02839d03e5b78931dcf416cb7fd414489a87410ef826cabcafd1f458b6af86601cdbcae75c2581e2aed
SSDEEP 768:2rv+4UNbdI30o4+LeSFOUKVtZX4fouOToPvB2thtA9VAgXPi9PMtZ:2bsbS30XsnnwthttWPPtZ
TLSH
T18813CF71B46C8D63DCEAE398720B76877FF410A394C10B94DAD95B4D098B9EE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 eec0fa52c73dd84fe1f7a192ee501f401094124411a16faa948b3d8c225adc40
MD5 b9b470bfb6cca2b185528b7ad708fef9
SHA1 79f808841ec73112c0b5ac4cb3f7166ceb4b75f4
SHA512 1d49bbebd30a6529903163470caaf2767ee47ea59b25978e44b0cb14aedbc06554ce3b23664f5e5f4ff95f3e1d627481f46dbabf19401f264cc51fe9092d9d5e
SSDEEP 768:Erv+4UNbdH3hm+LeSFOUKVtVX4fouOToPvB2thtA9VABXeVH1SlX:Ebsbh38snnwthtt9EH1Y
TLSH
T1D303CF72A4AC8933EDE6D398710B76876FF410A388800F94DEDA5B4D064B9DE170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ac29d19af5886800e69de6b09a374583e6649b9bd6e40e3dc8c22f527c4f354e
MD5 f153fc3413a0e052c428a18e76497599
SHA1 0425f96481e9b9fec39970c62b2d12080519a308
SHA512 c6041d83dc656756072a4e0b438eaaa89c6cb86114055a0436e80900b2c980bf501e3979255a3deb627de9a0706ce1927fb4336823b8859c30d9d5bf8b455b87
SSDEEP 768:grv+4UNbdH3E++LeSFOU5X4fouOToPvB2thtA9VAwxeVH1SlX:gbsbh3CsnnwthttkEH1Y
TLSH
T1CF03CF32A8AC8A33EDE6D388710B76473FF4515396900BD4D9DE1B4E069B9DE030BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2a4b1811069289b2545f15f2a4512fdeec3f8ebfae0450e8c96b7a6197ebfc0a
MD5 4f1a10ac76f7d9de3274bcd3cf93faa6
SHA1 ab687738baa6939b10dd09217ed601b31395b871
SHA512 0de096aeda5941bf72bed646b114f1a64a182eaa9fb5a6d8fce42349367048fccc4c3db461575284b6c678df834ec2e74b9cb3013080a07ed00622c9a78665bb
SSDEEP 768:wFQC3pwgSX4+LWRSbOUKVt1X4fouOToPvB2thtA9VAgXPi9PMtwm:jC3aEsnnwthttWPPtwm
TLSH
T1B203AF72E898C967EDFAD798B20A7382AFF000A3D4D15B94EBDD9A1C05475DE070BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d00b39f-becd-4d39-84f2-536f894df2ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d00b39f-becd-4d39-84f2-536f894df2ed.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_1846998525\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download