61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260816-nc6cdswfpg
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313525787441339"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{F42082B8-941D-401E-8D4C-A9EA908CF19B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6096	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 6096	5908	iexplore.exe	89
PID 6096 wrote to memory of 1412	6096	msedge.exe	90
PID 6096 wrote to memory of 4356	6096	msedge.exe	92
PID 6096 wrote to memory of 2776	6096	msedge.exe	94
PID 6096 wrote to memory of 2776	6096	msedge.exe	94
PID 6096 wrote to memory of 4608	6096	msedge.exe	93
PID 6096 wrote to memory of 4608	6096	msedge.exe	93
PID 6096 wrote to memory of 4608	6096	msedge.exe	93
PID 6096 wrote to memory of 1572	6096	msedge.exe	95
PID 6096 wrote to memory of 1572	6096	msedge.exe	95
PID 6096 wrote to memory of 1572	6096	msedge.exe	95
PID 6096 wrote to memory of 3004	6096	msedge.exe	96
PID 6096 wrote to memory of 3004	6096	msedge.exe	96
PID 6096 wrote to memory of 3004	6096	msedge.exe	96
PID 6096 wrote to memory of 3236	6096	msedge.exe	97
PID 6096 wrote to memory of 3236	6096	msedge.exe	97
PID 6096 wrote to memory of 3236	6096	msedge.exe	97
PID 6096 wrote to memory of 4124	6096	msedge.exe	98
PID 6096 wrote to memory of 4124	6096	msedge.exe	98
PID 6096 wrote to memory of 4124	6096	msedge.exe	98
PID 6096 wrote to memory of 4332	6096	msedge.exe	100
PID 6096 wrote to memory of 4332	6096	msedge.exe	100
PID 6096 wrote to memory of 4092	6096	msedge.exe	101
PID 6096 wrote to memory of 1804	6096	msedge.exe	102
PID 6096 wrote to memory of 4092	6096	msedge.exe	101
PID 6096 wrote to memory of 1804	6096	msedge.exe	102
PID 6096 wrote to memory of 5968	6096	msedge.exe	104
PID 6096 wrote to memory of 1512	6096	msedge.exe	105
PID 6096 wrote to memory of 1512	6096	msedge.exe	105
PID 6096 wrote to memory of 1436	6096	msedge.exe	108
PID 6096 wrote to memory of 1436	6096	msedge.exe	108
PID 6096 wrote to memory of 6048	6096	msedge.exe	110
PID 6096 wrote to memory of 2760	6096	msedge.exe	111
PID 6096 wrote to memory of 4688	6096	msedge.exe	112
PID 6096 wrote to memory of 4104	6096	msedge.exe	113
PID 6096 wrote to memory of 4104	6096	msedge.exe	113
PID 6096 wrote to memory of 2968	6096	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ff8b7a6c188,0x7ff8b7a6c194,0x7ff8b7a6c1a0
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,6402531006838880587,18241728428572225960,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,6909094706697252965,12626166861596527958,262144 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,3843892301963545818,10234332595467347928,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,15351258101677659057,10807073194101561313,2097152 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,13717381538849425803,9325371087814798801,2097152 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,9199003622465488078,11501022682796386534,2097152 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8899151404644275848,5537639732090212179,2097152 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,3482161055391101456,10724837003663454470,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,875481606320972513,6578035028924466170,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,15583202019219424877,8895894421567990516,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,8275521685395749499,16012504782294991954,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,8275521685395749499,16012504782294991954,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11861547721320604940,7614247839340352942,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,10170223611198910024,12382481614699718015,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,13187708453671053773,16744362436895725737,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=1184 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,8976244386977939312,6202579944693135649,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2479788619912347196,2724083323951863780,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,18119993724884568801,1192236862723626094,524288 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1300,i,2202263095874466986,17003105733087379199,262144 --field-trial-handle=2416,i,8366607452442057794,5336007065818933763,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8cff97ed-5bd1-4dc4-b80d-f79284ac4114.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8cff97ed-5bd1-4dc4-b80d-f79284ac4114.tmp
Size 36KB
SHA256 2c86584ea0da371ffe350ce433cf7bf80ddc92bce45c3738c35207271a33d69c
MD5 186dfbcf4f1c027c0b80d85002e82c2a
SHA1 bfc4d371b5fb8fff9203d7227debe7d2c7d7dfbf
SHA512 92d915aaff0ec5543664040401337439d2de34287c45fd516d699ddfa99f38294e13748c53ad905c1cb780697364f3a865238082d2a2c2d067836a36c5c96981
SSDEEP 768:YU3PmuxsOWT1a5PONXyer1IRCzni9APi9Pitj:YU3P3a6PSIqnvPZtj
TLSH
T139F2AE74E8A5DE636CE6A3C6B2467787AEF82067D5C849C4DDD96F4D00C365E030B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4188f6030929aba41c4bd8b40885c90d868af7ade07eb468586b55ab1aa1b08d
MD5 bdc0689081d48dfcbc6f5a21d0ea2252
SHA1 d0ebfb3ec019ef05aa56b370efd82718a328fef8
SHA512 f409633bea9849adb9015927776c5d243f40bd2b7161bddf2bef4667d3302e24c6187e62dca4960b0f5fbcd26d80ce53eafdcbe695d2556f0135da7163b35bd1
TLSH
T1015151612B2D29E3D7B6417370E5195936FFC40942AF1E20A0D45D745D22F0F9CE3867
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59adf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59adf9.TMP
Size 2KB
SHA256 548469c7431248454e815f68f3589ec593687337881c1f6935108857546b1489
MD5 6eb1e44d737256ea908028916e85cedd
SHA1 b7d63b60edd0d01848f91ac20abbcc6e3241d245
SHA512 7b05d7c284ce2f196c8c29e5320264c34a0cf4e605f0d1a7eebabeaeeee2e37ca665b62f8494bfa52e98f94b982585e348c8b978e0ad9e60d147916e65ba4947
TLSH
T1A95161612B2D29E3D7B640B3B0E5195A36FFC44942AF1E20A0D45D745E22F0FACE3867
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d7705d18767e9453739463d06430466a7e1f383391914d125fc12a300c50f8f2
MD5 c49cb8b0f902259786a8ed1528711cd2
SHA1 197bcf97848fd5967e324fecb072540519780b99
SHA512 e139e14e96e47afbd03f76bd78d7f659ef9b254bc7a2ca99c71f11d49a27d0228799273d1c735be2c1424bb231ce14b97bdf47c72a6d19fa26c0be5b1c3576b1
TLSH
T10A41A0F3C3F4956E8A0196F0AA146E1FCE2D0515432C7D5AC9E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1bdd8c03d976ead0d623953f0ec53c23b12a031f7d0eb84d60f347e405e32826
MD5 6fcb74e5323fa9c054e0aa51b4162176
SHA1 ae08616b97ae41df139106fd5e9096c606139df7
SHA512 30156deda0ecb0243f034c244879fcb4469e5079fd8ab23b88e4a8a36e3fc37a08e32088edf189eab7e63654b8d9b35482c6077d5f00c3871982bc340988b9ac
SSDEEP 192:sxRaRbCR/fzsS14aZa7zoA8p48/g6+WNIYofpCYFGSIgD+uJ:sxRaQR/fzsS14MZt/5I0uB
TLSH
T1E842C8156D68A97B9CCBE20CBB55BF53D6F95032A0902E48EBFC961C00E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c4c0a2a2aa97fe3582db233fbe8dde3dabb538b956ae7fbbace0f09241249278
MD5 69cd6e5e2b519c6ddaa1af407c3c5842
SHA1 191a0a1fc07913209fbe6db2f73dc52649a2b03b
SHA512 a14883ec93067d8789cf838f0ef61610b4dc34f4908b017119fcba25baa658ca7759b83f9c46f5a8192d27a450eb722ed78e5a0019f70cdc46a7868e748f0994
SSDEEP 192:sxRaRbCR/fzsS1HaZa7zoA8p48/g6+WNIYo5dCYFGSIgDMuJ:sxRaQR/fzsS1HMZt/5ISu7
TLSH
T1FE42C8156E68A97B5CCBE20DFB55BF53D6F95032A1D02E48EAFCA61C00E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6c479376bd59570c455cc8d3e40576564da152c1bc497c844343aac335b1ed6a
MD5 7f8c4e189b6adc420c68be11b4369673
SHA1 3ae31b33a138d5ef0379222030d577d73a2f181f
SHA512 9048675ab59f5f3ef49fe181dbc9a13521b954c337344b6e47383c91d20c6b8bad2e90889c9663585eca2a1c5f99a97efb20e8db41a39956fc7ccfa2ed4d82f4
SSDEEP 192:sxRRRbCR/fzsx1HaZa7zoA8p48/g6+WNIYo5dCYFGSIgVuJ:sxRRQR/fzsx1HMZt/5ISuM
TLSH
T17132C8156E68A97B9CC7E20DFB55BF53D6F95032A1D02E48E6FC961C00E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a5b76de9cd620077ac4ad31d7a7a9493530eb55f7742208f8a296bc85ed599bb
MD5 de495d97ff9d68b77eac020250de57d4
SHA1 ad9bb0d6f4f3245ae0d50c31ca2f9699cf67b14c
SHA512 087da6010ab79ef3dc4b6cfd4deab2dc40841c503aabda3e2ccdeaaf5e8e955b564131f12fec6ba4b64a5da62e643b2d283fd1f4e765af64df5b8752b70f5277
SSDEEP 768:j26Hjo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVsDBVuwcro9de0i:j26HjUE7MRWgs2f02u1ja/DB4wHs9
TLSH
T113D2DA7B640DCBBF4F800ADDEC197E9E6D6802CB9698CD8047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e1b1ac026b4bef95213267bfcffc6dd0c0259e88c9ae44bc1073300f180bf1ed
MD5 84e7f409df1697ac35c90e790cdc6a0a
SHA1 50e247730ae0cf8335fb68b69c67b0256a37804d
SHA512 87f116058637fbda7e51a31d891cb08cbf5d424691de2e4b8bdf7a387554ea2cf53c39a5b268d9e8e79fcf16379d9bb18134b282551f7c621f9bb6c79cee04e3
SSDEEP 768:um3imJ/TBOWT1a5wONXyer1IRCzni9APi9Pitj:um3i0j6wSIqnvPZtj
TLSH
T121F2CF30E9A4DE635CEAE3C6B5472387AFF82077D5C44694EAD9AF0D058351E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8f2962b0fc23d60671bcb24a53ee8cad99dc4a669d5735e6820106038d77f589
MD5 5c5e28a57c4581b23ce24876ee7501c4
SHA1 8dfb20d1a9f1a0a62467430ab5fb5dc1bf259f5b
SHA512 d4f13d1e6f4255f7e706b0ae89b24e4a191f38f96d7eacdb740b7e7248c828b6732d0d746ec300ea1d738cbde1bb4cc023b9d6605389f0ea4277b930ba66a797
SSDEEP 768:hrv+4UNbdz3Rt/TBOWT1jONXyer1IRCzniBReVH1SK7:hbsbV3LjjSIqniEH1l
TLSH
T17003CF36A4A8DE338CE2A3C5B04772477FB86057D6840790EDDE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8343542c63e712f6eb679da02cc878b7d45c03dea9724c112f1e7370fa6d79e7
MD5 459311f8f35344aac2178c91983ea708
SHA1 4aa2f100a60205cffebdd50f1570ff1e9dfcdb38
SHA512 855af2d433417d819c64a16db70f37bc6316e8340e3728f4875fbf91439b7e5d7fc03260687e20bc1044a35fa67f7a0d69a2bfb43b6c4a43fbc108f19663e4eb
SSDEEP 768:qrv+4UNbd93i9J/TBOWT1a5+ONXyer1IRCzni9APi9Pit7a:qbsbb3iPj6+SIqnvPZtu
TLSH
T1E713CF30F5A8DE635CE6A3C5B04763877FF820A7D9C10694EAD96F8D068759E230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 099f06491165501e7f4ae01d1cb0f3e2603c76af391cded5ef6e8884c992cfa2
MD5 267b00fbf1c84cb56d1924269d8dedbc
SHA1 5fe1516fd16fd37281d793a10904835acea2cad9
SHA512 aefe0bbe6dc15e0f173691aea9f767939ca39e43b8db81bd57f9ae91e8419b19ca5cbef8a6a9540ce190d4a41b5f3b9e8909bd38960a812974c907d3a0b2a4fa
SSDEEP 768:3rv+4UNbdz3y//TBOWT1a5FONXyer1IRCzniwAeVH1SK7:3bsbV3ij6FSIqncEH1l
TLSH
T19F03BF31E5A8DE334DE6A385B047A2877FB8206BC9840B90EDDA1F4E059758D230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6c017c3b44ef499fc6edaf1632841e4cf8845feabfd204a6314a0bc71e6e5969
MD5 6b85af1360b3f98b904efb051f52371e
SHA1 4719ba4f32b92c4942e4cb5210e594bd226d5c6d
SHA512 cb9e3da96c9e6b53510a9075cc476310e18c389c97b0ab5bde737a7e4de7969f67383ad84691ed6c81ded5a9f2d328173fb6f4f3aea1c24d46ce6f16a3f9ed54
SSDEEP 768:Dm3PmJ/TBOWT1a5wONXyer1IRCzni9APi9Pitj:Dm3P0j6wSIqnvPZtj
TLSH
T16AF2CF70E9A4DE635CEAF3C6B5472387AFF82067D5C44694EAD9AF0D058361E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14555da2-aef6-448b-9499-01f22d099e55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\14555da2-aef6-448b-9499-01f22d099e55.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6096_1191202985\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download