f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eM.svg
Size 3KB
Sample260816-dkl9dack21
SHA256 f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab
MD5 40ed26c24cc55b701d2198147f4dd511
SHA1 be79a6dd7f18c178a4419eb98dd433ab090071d7
SHA512 6640d83ea0c3300598f061d3914e839c94e0dec416692dbed5dc1e857898e7467011e2e986cc39131cb59505b3705d679faa8e61cff117e12fc356edaceed39e
TLSH
T10271378876F87EEBC78802970E51D4B84B2F906BD822978DD3CB94D8792C2AC735D570
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313230573886680"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{F5D7414C-4D00-4EC8-97F6-C1EF232E7144}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5268	msedge.exe
5268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3424	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3424	3968	iexplore.exe	89
PID 3424 wrote to memory of 3084	3424	msedge.exe	90
PID 3424 wrote to memory of 5700	3424	msedge.exe	91
PID 3424 wrote to memory of 4872	3424	msedge.exe	92
PID 3424 wrote to memory of 2800	3424	msedge.exe	93
PID 3424 wrote to memory of 5700	3424	msedge.exe	91
PID 3424 wrote to memory of 5700	3424	msedge.exe	91
PID 3424 wrote to memory of 2800	3424	msedge.exe	93
PID 3424 wrote to memory of 820	3424	msedge.exe	94
PID 3424 wrote to memory of 4724	3424	msedge.exe	95
PID 3424 wrote to memory of 820	3424	msedge.exe	94
PID 3424 wrote to memory of 820	3424	msedge.exe	94
PID 3424 wrote to memory of 4724	3424	msedge.exe	95
PID 3424 wrote to memory of 4724	3424	msedge.exe	95
PID 3424 wrote to memory of 5668	3424	msedge.exe	97
PID 3424 wrote to memory of 296	3424	msedge.exe	98
PID 3424 wrote to memory of 5668	3424	msedge.exe	97
PID 3424 wrote to memory of 5668	3424	msedge.exe	97
PID 3424 wrote to memory of 296	3424	msedge.exe	98
PID 3424 wrote to memory of 296	3424	msedge.exe	98
PID 3424 wrote to memory of 2168	3424	msedge.exe	100
PID 3424 wrote to memory of 2168	3424	msedge.exe	100
PID 3424 wrote to memory of 5204	3424	msedge.exe	101
PID 3424 wrote to memory of 3460	3424	msedge.exe	102
PID 3424 wrote to memory of 5204	3424	msedge.exe	101
PID 3424 wrote to memory of 3460	3424	msedge.exe	102
PID 3424 wrote to memory of 420	3424	msedge.exe	104
PID 3424 wrote to memory of 2992	3424	msedge.exe	105
PID 3424 wrote to memory of 2992	3424	msedge.exe	105
PID 3424 wrote to memory of 4316	3424	msedge.exe	107
PID 3424 wrote to memory of 4316	3424	msedge.exe	107
PID 3424 wrote to memory of 5844	3424	msedge.exe	110
PID 3424 wrote to memory of 5484	3424	msedge.exe	111
PID 3424 wrote to memory of 2900	3424	msedge.exe	112
PID 3424 wrote to memory of 3404	3424	msedge.exe	113
PID 3424 wrote to memory of 3404	3424	msedge.exe	113
PID 3424 wrote to memory of 5268	3424	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eM.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe6c6fc188,0x7ffe6c6fc194,0x7ffe6c6fc1a0
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,7327813954075717379,3958581968141013847,262144 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,18043383621387253772,5107978724988374919,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,14335638763456344184,1974249097788284543,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,14933203786109155829,3000421795397293832,2097152 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,17025916529375181824,11722110332151277693,2097152 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,3122403915981386456,16748628964090581564,2097152 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,8425426321595221598,7570971300031274959,2097152 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17067077331798604852,3355157480064933972,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4892817400629009051,13287324033137939433,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,9430303530321593008,16501807758046134997,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14134764244312526964,17628073185029887645,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14134764244312526964,17628073185029887645,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17132314304247533891,1649453502390108336,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,5762580915996715801,11320573134853215860,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11056424004918428124,14825095605902720699,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,3374525210310481203,11754578523683362262,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,2542214138774804834,12350338033270624848,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,12224164208144538709,15899381966840634749,524288 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4856,i,3668493833148292048,1440904050901306207,262144 --field-trial-handle=2192,i,798420888337121262,13640231786955014488,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

89f05666-f5b6-4076-a96e-d83588bd14e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89f05666-f5b6-4076-a96e-d83588bd14e3.tmp
Size 36KB
SHA256 faad10ba73f27efc3eb265b41dcd6ca75def0f1a277039ef52c9473c00356609
MD5 b4790e7ce53f2d9eb13602c4852f4734
SHA1 364e92cfb052cf08d094682c7335b257e80e3886
SHA512 ae883570c280eb9327648e8cf07d3e9dde1aac038d33a637a9b8f2a9f78e154b900abde3933e15afee585cdaadeda6c1375ceeb06cf25ec1471d57d76bdde2db
SSDEEP 768:7xM34uAtfZOkfbfI66QvShCQRtXPi9PJ0:7q3ef7fbfb6QvShXP9
TLSH
T1D3039DB5E874AA63ADE297C5A7457B07FEE55263C1C859C8CDDC5E0C00C36AE170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

47dfc91d-f747-40fb-a2e5-895afcbb606f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47dfc91d-f747-40fb-a2e5-895afcbb606f.tmp
Size 11KB
SHA256 0831eab8a45ac2db9d552a36167ac545d41ff3967e8cac55b3d1acb5ad5607a7
MD5 f90d56861f38385b6410de410a257578
SHA1 51d2e0b9a42347accc1c25a222b0596f9702d84e
SHA512 5c2d3cd08bdbcedddb32b362d98983e3bef704824c80a98290148d4f410771f39e683be267233452a80f71851447559d5690ad2642e895dbd17eeed326e757f8
SSDEEP 192:sxRPRRCA/frsk9LYdMoZ/czoD8p4V/g6+WNIY3JcdG1IgDonJ:sxRP2A/frsk9EdMW8s/5I4c
TLSH
T14C42C816AD28A93B9CC7F209FB55BF53D7F9607261901E44ABFC861C04E7ADD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 12be4af045099caa46739d1b908364e3c551db883ac0f0ccc9033977c6c9feaf
MD5 53a8ec6c532b244f6d06794f61de55f2
SHA1 d04ef79b0ea02c660d83abad5c61fe591a3455cf
SHA512 ddd0cfecc42c315a3863dd24459481bd4abd903dceff6c5b89ea25a1a749416bb5dc59f5a70730e9da350b828d91e980b2b4e3c69fd13e3da6487cf0c5d880d0
TLSH
T1885123095373CAE1E7A592F951E1C7CFFAF885DAE2876E30490BAD38695BF4510E0053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59764f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59764f.TMP
Size 2KB
SHA256 55a79b3bec01a716475ba9aa77ab17e0aa3a4af750e533f9877f9a42f0fc0506
MD5 b89123cd02284fcc2f2a06c084148d3c
SHA1 1a0e26b5ee40c1ddfac2da720405590baadd593f
SHA512 95bede2ae07886b17313668566d3af705b9948446ba56f126ecebdfb535dc0008b60735ac41b90e57aa1eebf49ce975edd7046fd17dbc082a359f59793fa66a2
TLSH
T16C5130095372CAE1E7A592F951E1C7CFFAF884DAE2876E30490B9D38691BF4510E0053
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 aba7e22635d3c8ffb6c3489ec54decdb5f3011ec5836f15c7da62ef5e05014f9
MD5 8d28ca738d6014d25e0d44626dc1de80
SHA1 16ed6d0ffd8ca372f49c9402395633980056589d
SHA512 82ca304fac9e9f570d97c61a02ee64004b45d596ce78c6a7b78ee9816472bcbb4ffc3aac0d5d1d43e2f00d102a5a7fd71f9edecad7a670debd96a3aa05ac75ac
TLSH
T1F6419CF383F4856E891156F0AA146E1FCE2D0525432C7D5A89E0EE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 33e181e0b59b45f5c7a08854a054671e5cc5fa38f5b9a0e550503315243955fc
MD5 069e29492d1a6d9c2e6d5b6db0a60a9e
SHA1 b58a6ac38624fdc99d05ef8c7e94a6e35ecb9d08
SHA512 049235a95adb3fe0a9f9e9bfb562e2a97d17c9ff8122512c71dfc69a83991275079f4cd4a489a5fd6cbc0b85705c0e68c1fbb9d22e83dcdf7f59240f515dd687
SSDEEP 192:sxRERRCA/frs29VYdMoZ/czoD8p4V/g6+WNIY3B2SdG1IgVnJ:sxRE2A/frs29adMW8s/5IAc3
TLSH
T14932C8156E28A93B9CC7E21DFB55BF53D6F9603261D01E44AAFC861C04E7ADD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 41dde6b13d0bf04d076550f63e665ace234a1704d99bd36f8f19a5ccb3c02304
MD5 224c91ee938525fe7d4d02fab9ef58c1
SHA1 e6e203129fcd55d3ec28406030bf005747a00823
SHA512 2c6fcf3b2a46b7302992a72fbb1ae1b8bfe137eff560f819fb5d5bb1871e4aba1b131cb4fb088c5d20c188ac1501cefa3668234e639da675603192d45e4c0a91
SSDEEP 192:sxRPRRCA/frsk9VYdMoZ/czoD8p4V/g6+WNIY3B2SdG1IgDSnJ:sxRP2A/frsk9adMW8s/5IAcu
TLSH
T1CB42D815AE28A93B9CC7E20DFB55BF53D7F96072A1901E44AAFC861C04E76DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8e84a6e39ff05507afc822893ee57c6a5dc049d70e23d2116f1dc808739f1153
MD5 47dcf0596bc89a2e84be8724b55bb6d7
SHA1 c3911d8326bdbf073918d837dea92394f85b5bda
SHA512 2eb5ecfdd7a26ff6268b428edf9a6ba05bfeee4dbd55bc9bed835a9121cc5f190b823367c22298bbf1a8921f0ce8788c7677deab8b80a7c9ef6e5ac23028663a
SSDEEP 768:GTEbOo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfGgMWcjroy2i4:GTEbOUE7lkWg0CfKsu1ja8GgFcQyZ4
TLSH
T16ED2DA7B740DCB7E4F804A9DEC19BE9B6D6802CB9698CD8047FE941C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 38a52ebac751eb065010579c74661908ef4dc258530a6a4de2f4633f6602dc59
MD5 61530859a3303e5fc80d6e3fd9aa0044
SHA1 441e2f1a791977ebbf25692769f7d0a209348907
SHA512 a963027053b7968849226888d5ae5171b96471ac87e4b2bf6cf4f825a26c7ca0bbd5b328d5e66735af25131299adfeb4b5ff719e1e486ba3a0620cd97c60f965
SSDEEP 768:IH34ac+wfZOkfbfI66TvShCQRtXPi9PJ0:IH3Dwf7fbfb6TvShXP9
TLSH
T1D2F2BFB0EC7429739DF6EB85A7462B03BEE5A263D1C45648DDDC5B0C01C36AE171B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 83a23d0c0fd67d413833ec26dc7223198e02d1294f18e765a7184b1266691f38
MD5 9381e9eaad68cc87e98b3cabd98c113f
SHA1 95c399ef07c82f54a79049d68b40b9bf070cd73f
SHA512 5391897cd5335dfdadc70fe312751bc420213fbc67343e9084d4c89206ec8301b4589953468e020f357a3de201f4d84d19fd19795329ff6061a8359f54e651a5
SSDEEP 768:0rv+4UNbdo3jac+wfZOkfbfI662vShCQRtX2bwWv:0bsby38wf7fbfb62vShX0wc
TLSH
T16413BE71E86869339EF29684B6467F13BFA5A263C4C54684DACD1B0D01C76DE331BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 913d4e04fbc98f95591558a563097355645f141ecd386883581d423da9d71601
MD5 c2b547358a4a08deab7d2d8b32e402a1
SHA1 96a76e4ad3315754ed7fc268786036b1d3f11551
SHA512 e46ec022970a817c2233e12f986c744e554a290f72f3892f2f1e16c5cbbadeb2c96d5633b007ab101c6453b66c856c60625ea1d6b3521e5101ed18646400c97a
SSDEEP 768:Rrv+4UNbd43nukc+wfZOkfcvShCQtw2bwWV:RbsbO3nzwf7fcvS80wO
TLSH
T1AC03CF71E86859339DE792487646BB637EB86263C8C54784DACD0B0D029369F370FC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 069fc94c7a81314574c8b26d756b0a1bce99a09002c470a62e847b03a6cfc2b3
MD5 59842a404ddc98033d654c6ca03d7a41
SHA1 d608749dd919b98b5d12414b07ab9a733f7e8a35
SHA512 4c9af67ab59bfd1731ef6357d086e18686c5075b90f2ba3cc2204c242e00f1ecd1ca1c5d47a9b7b9def9c3cff5670cb3e44136fd280724b4dfcf77b1722d4c4d
SSDEEP 768:4rv+4UNbd43WMc+wfZOkfbfI66QvShCQstX2bwWV:4bsbO37wf7fbfb6QvSoX0wO
TLSH
T17603CF71E87825339EE396887646BF13BFB9A263C4C54684DACD1B0D018769E331BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3424_758780292\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download