42f3ab149092a38d40fbbc6bcbf0b629bc5a433e62eabbafba8a445de9b88b62

Analysis

max time kernel
148s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v19S-m5-eL.svg
Size 63KB
Sample260815-ey86qseq21
SHA256 42f3ab149092a38d40fbbc6bcbf0b629bc5a433e62eabbafba8a445de9b88b62
MD5 f18d08462e03abffd185eb85868309f3
SHA1 dd183829fc35212fa44c1eaed674ab5a4eec0528
SHA512 976524dfac99df9110a4e493d412b20f4a979b4ef3762a94a3b0285d66506b35d53e8da757a0bf5469830a5f9f99e84a2b77b7731d6efc5f845d5e01b183a4c8
SSDEEP 384:ciIVpu6WpeE5gyDnGCeTSC9wbhJaSFMczb4KlBHYwMdfq/ahUfLFjIcCcvGjIqaV:c5pZW7isuIqIx
TLSH
T18653C26637F4BC9B8BCD034F5D02EC6C85AF94B784A86ACC97C790E89548368B7EC550
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5388	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312413405016298"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{6D79746F-D2E2-408E-B07C-7F69AC60A3B7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3868	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 3868	5616	iexplore.exe	89
PID 3868 wrote to memory of 4560	3868	msedge.exe	90
PID 3868 wrote to memory of 1068	3868	msedge.exe	91
PID 3868 wrote to memory of 5388	3868	msedge.exe	92
PID 3868 wrote to memory of 1068	3868	msedge.exe	91
PID 3868 wrote to memory of 1068	3868	msedge.exe	91
PID 3868 wrote to memory of 4324	3868	msedge.exe	93
PID 3868 wrote to memory of 4324	3868	msedge.exe	93
PID 3868 wrote to memory of 4688	3868	msedge.exe	95
PID 3868 wrote to memory of 4688	3868	msedge.exe	95
PID 3868 wrote to memory of 3352	3868	msedge.exe	96
PID 3868 wrote to memory of 4688	3868	msedge.exe	95
PID 3868 wrote to memory of 3352	3868	msedge.exe	96
PID 3868 wrote to memory of 3352	3868	msedge.exe	96
PID 3868 wrote to memory of 5988	3868	msedge.exe	97
PID 3868 wrote to memory of 692	3868	msedge.exe	98
PID 3868 wrote to memory of 5988	3868	msedge.exe	97
PID 3868 wrote to memory of 5988	3868	msedge.exe	97
PID 3868 wrote to memory of 692	3868	msedge.exe	98
PID 3868 wrote to memory of 692	3868	msedge.exe	98
PID 3868 wrote to memory of 2324	3868	msedge.exe	99
PID 3868 wrote to memory of 2324	3868	msedge.exe	99
PID 3868 wrote to memory of 2716	3868	msedge.exe	101
PID 3868 wrote to memory of 2716	3868	msedge.exe	101
PID 3868 wrote to memory of 1208	3868	msedge.exe	102
PID 3868 wrote to memory of 1208	3868	msedge.exe	102
PID 3868 wrote to memory of 1868	3868	msedge.exe	104
PID 3868 wrote to memory of 5396	3868	msedge.exe	105
PID 3868 wrote to memory of 5396	3868	msedge.exe	105
PID 3868 wrote to memory of 4608	3868	msedge.exe	106
PID 3868 wrote to memory of 4608	3868	msedge.exe	106
PID 3868 wrote to memory of 5472	3868	msedge.exe	110
PID 3868 wrote to memory of 2812	3868	msedge.exe	111
PID 3868 wrote to memory of 2776	3868	msedge.exe	112
PID 3868 wrote to memory of 2972	3868	msedge.exe	113
PID 3868 wrote to memory of 2972	3868	msedge.exe	113
PID 3868 wrote to memory of 2548	3868	msedge.exe	117
PID 3868 wrote to memory of 2548	3868	msedge.exe	117
PID 3868 wrote to memory of 3392	3868	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v19S-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v19S-m5-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x348,0x7ff8b2b7c188,0x7ff8b2b7c194,0x7ff8b2b7c1a0
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2332871939745841611,3038914582402343845,262144 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15273621997135165378,1856795600871040341,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,2789414949036048506,7304046535341862447,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,2700195638850791633,14326771799926233496,2097152 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,13989092217275333884,7094826688713028757,2097152 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4412,i,8244288259745364608,4211960659700251283,2097152 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4428,i,4830722213136937625,14206355665381473449,2097152 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,8425844792101338854,2635022805144562720,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12792227316714621153,11238200805087822392,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,13922511771461822742,17619641580349594451,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,8300702099155715645,8803079224771322100,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,8300702099155715645,8803079224771322100,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7447092254231222621,1515296472527980442,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,15993673024699934159,3656240944666037943,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4025221443115336541,9340443964341358757,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,8675113448161748249,7560986444060495474,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,16675005979588001592,16068275253112358973,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2090444388627384018,3581469338095911065,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:14
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,7783318297138719234,5596345268747828491,524288 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5908,i,11090996654158876463,7510591319957156051,262144 --field-trial-handle=2344,i,12947068028619526655,2669461471723500181,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c99f1a85c5266f718f64b736fcd333141022f4a211591126e362c85e5a6be61a
MD5 55814920dd0dbedada8360bc56ac0fbe
SHA1 ba5d1a4a3c312aefe3ade6f232897d3b741f1c71
SHA512 996978cc4f3533a9cd5eea0eea1ef2680a19b206525068c0ea43a79da8f4f66256862aaab3d026a2e230375fae69a2eb0eac44668b5e52f0d2c0e098e78884ca
TLSH
T10841B972833418E5DBA1C5B660E0D25832F4C09DC70FAE9ED0F85DBA4A42F4856F212F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c104.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c104.TMP
Size 2KB
SHA256 ea477ea1cb26784e1281e2290b640ac92144d0ee3d8eeb37d04fcff6322c9b0f
MD5 7c72bde42b088a2f7151830e766c3a8b
SHA1 34ab9f0ae8ef780eef257f383ecd3bef99b6fa69
SHA512 f213968b4a732c0e9a31f456795a100ca846c4fa2cb4ebc930c87fff3360c973e3228fc50e22847cf6d3696a5a1db5a0ee32fdbfcc71fa3b46d9feb6867c09ca
TLSH
T18D41B972833018E5DBA1C5B664E0D25832F4C09DC70FAE9ED0F85DBA4A02F4856F212F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 804a4f0cc1c8ec472f4d0936fa0a56786abd0f0ea79db858251e3a05e0661401
MD5 5afccc6e9f7009fa31ae98f48a6fe792
SHA1 ce54cc70307d554666acce68163e67587383c907
SHA512 0dd6cc912de3f241e80ada4b5b7471875efe7534dcb86d78681c7d02c70e908f66c8f17ff65bf22cf6a9a71e07b017786b20502147d0d1440c51b438b98e226c
TLSH
T11941BDF383F4856E8A0196F0AA146E1BCE2D0915432C7D5AC9E0AE2B93E3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1db44eee9c951045a2035818b1040a92f1d95b594361be6579284492ab70f335
MD5 c076632c32dca187a97c362472e4bea2
SHA1 a70f7b876c74b944ba9bcbc89f3ebedcbf5ed89c
SHA512 e13fe3e7e46fbb657d0f322130f1c95c62a1474006f71169f315ed9fbd39ee1a6ff51ce68d25c378d5b3f33187c641275ef338c9b482d445948dc8444d1a9269
SSDEEP 192:sxRdRBCM/fmsRF7ZvwzoA8p4r/g6+WNIYZFLKorGMIgVYJ:sxRdGM/fmsRF1Re/5ISpi
TLSH
T1633296156D68A93B5CC7E319BB55BF53D7F91032A1911E48EAFC8A1C04EAADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6952d764127592f27616b339cfbf736cbc3d94be8f0b13b462a2dc9a64c12dd3
MD5 ebd1c8e3d653cc7c1ced8286675ad636
SHA1 70be7219231d54c070cd2979e52ead02bde233db
SHA512 2ebf221ccc4bd754ceddcd710562d1b6f425d2061590e31585590fe3ce55224d10af74930a320635ecefdbc48dad6f079fc921dfc7802b2176d5225eac4a20ec
SSDEEP 192:sxRCRBCM/fmsSF7ZvwzoA8p4r/g6+WNIYZFLKorGMIgD+YJ:sxRCGM/fmsSF1Re/5ISpT
TLSH
T1AD42B7156D68A93B4CCBE319BB55BF53D7F91032A1911E48AAFC8B1C04EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 50cf2ed85cb14633e7e3af022bcb68ffdb3719545b859b01eff0916c8a0d7977
MD5 e59eda49a8b4ce5d3f7be6552e8654f1
SHA1 37919a092a1e35cba7ebd1ce2ce0709ceb31fce3
SHA512 5834fa84bf0c6625022240c1585bf1dd47798df512dad6b163ed8ee3a36fd738f3837e8d81cdea306ebedc209b8df69b05cd4b400d2e312ac19994e1f56db6d1
SSDEEP 192:sxRCRBCM/fmsSY7ZvwzoA8p4r/g6+WNIYZFLhWrGMIgDkYJ:sxRCGM/fmsSY1Re/5ISgJ
TLSH
T1FF42A7156D64A93B5CC7E319BB55BF53D3F91032A1911E48AAFC8B1C04EBADE220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e67cc0751e26d61e41e7ce73995a957899533fd2abcd14d84d1359c7c67112e7
MD5 9f0f9d303118e070ebb27145fdde516a
SHA1 b092085d260a0ab510b1134ba616bba07401bbbd
SHA512 57eb0d5f0c9aa048a002d0d3a646d2f488c9ff7d31da5931e1348ab9d9c319668ba08b1d12b8dadc810f962d2d0cb46998bd365ae78175da317e9a07d60340b6
SSDEEP 768:K80EU67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYkowLWqMroLmU4:K80EUSE7FwWgNhfVNu1ja7kogW0LmU4
TLSH
T19AD2D97B740DCB7E4F804ADDAC197E9A6DA802CB96D8C98047FE851C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5b60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5b60.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 051081229a57971bbf109799e1065ba7548906f0558436aa5d423fdde684ade3
MD5 34aab5d50207fac98054b1029c354805
SHA1 6b44d147dd49d835d04181a1005722187e6f2183
SHA512 894c015c4d90eb086d57bef910f9b86a434608f7470e4c038310dcbd7b2349d3392dd6aa6d04cb8e582d14dc23cadab1e3691977006e82e2597cfacc5b0ada09
SSDEEP 768:Irv+4UNbdx3RU3p+LeSFOUntbaX4fouOToPvB2thtA9VAgjeVH1Sl1:Ibsbb3LgsnnwthttSEH1i
TLSH
T1F713BF72A8A99E33DCD6E394710B72832FF4516398C00F94DED95B4D068BADE170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 45eacff246040d5da4867cfb8d56a22cb796f0b46ae5b1618d7ce005fbdba56a
MD5 93ab444bc22639adbe62ee1819e9d924
SHA1 758d20c7abd7d050bd9e7aa0d35d6e8adf9d5c39
SHA512 088c457fc6c5d83bcccdd07f7b36356dff59ed54636f11b1d1a026f2d8c843baa1d62b0239486c434cb4edba9d4f781ef6c47be4917b3d0d65d99c63b062069d
SSDEEP 768:Xrv+4UNbdx3oUhp+LeSFOUntbaX4fouOToPvB2thtA9VAgjPi9PuZ:Xbsbb3mgsnnwthttSPL
TLSH
T1AC13BF71B4AC9E23DCE6E794710B72837FF4116398C10B98AED9974D058BA9F1B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 254f20d68cd1861e52438e979142fbe24560e9e42f179b3cf290eca517a36d3b
MD5 4ca5eee86bf4c39762fee621feed5800
SHA1 1c695917bc289807e13d86be6d9c02a16ce5e2d7
SHA512 8f683b4af663af04a30280bd38137ede20a79e18030c0e70d51d0ed0f973e936af373eb98ac1ab90a5223887c0eaebf34f1da2fe2ff2c9a6f75b645d88e203ad
SSDEEP 768:tG33Uhp+LeSFOUntbaX4fouOToPvB2thtA9VAgjPi9PuP:tG3PgsnnwthttSPZ
TLSH
T1E7F2BFB1A8A99D23DCD9E795720673836FF05163E4D01F88AEDD970D0587A9F0B0BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0f4768ffb2365e35bce70b44f6f7e4eb2ab14a8cf884349c2f349135029a0e78
MD5 b6deb843be446cf47af49debe282ebec
SHA1 270c7fc86882088dc0c1d048284f670436c69d16
SHA512 c33e67f47f27cd88c350aef3247dc0d3784239fec46ef62387df714acf2b05eded67c2352c8e30197e3b5606de31c520d26d5dfce1ca581fc25ecd19763da3bb
SSDEEP 768:Drv+4UNbdH3Pj+LeSFOUntbZX4fouOToPvB2thtA9VABjeVH1SlX:Dbsbh3kpsnnwthtt1EH1Y
TLSH
T13B03BF72A4A98A33DCD6E398710BB2832FF4516399C00FC4DED95B4D0647ADE170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 60f276e8164c67c93e260682961f795023f2ba5c0962e64827ed73a280b09c11
MD5 53e797a7440bac2df75797889db046f4
SHA1 9438a2ba5c9b0939c3ac5259643f606b24f17bf2
SHA512 568dd48004474323d29bf30f4eabafcb3e3e453735a046c8a9c3c77161428f14dee7c0c7825675716d0e80166ee4277b4ec5ee2414def7bfdd22d8f2679e0b03
SSDEEP 768:grv+4UNbdH3te+LeSFOUnt4X4fouOToPvB2thtA9VAwxNeVH1SlX:gbsbh3+snnwthttaEH1Y
TLSH
T1EB03CF32A8A88A33DCE6D398710BB6473FF4916395D40BC49EDD1B4E069B9DE030BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 96d0684edc6f9ee755044463ef82088238e57c8cce85121fd7a67bef116d9100
MD5 2a7de474ff622ef97e1333f02eac5bbd
SHA1 356406cc5c071679b76522d1e2a5e02e4e53775c
SHA512 eaca114389e60cf1311a6afdbff436697ff152218f766866f8bc8fd8154dc2b4366b04439864976b57d47932bd259e96258cca9586f094f6171a831c89341a3a
SSDEEP 768:ZFQ+34wgiUhME1OUntb0X4fouOToPvB2thtA9VAgjPi9PuP:Y+3o6snnwthttSPZ
TLSH
T137039D72E8A8CE27ECE6E7D5B30972879FF05163D4C45AD8EAD98E4D008769E070BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0c4b4fe-4144-41aa-afae-d1ecf1a2a29e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e0c4b4fe-4144-41aa-afae-d1ecf1a2a29e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3868_1789317977\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download