691bebdb70a39edb56c9a4573b009c8feecbcaca5b438cd4e5454b351b4c5f91

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v18R-m4-eM.svg
Size 57KB
Sample260817-xzy19sysc1
SHA256 691bebdb70a39edb56c9a4573b009c8feecbcaca5b438cd4e5454b351b4c5f91
MD5 8b9081c1b97a4eac196685a1f8617477
SHA1 89a34da98763f220cbdfc9dfaff9157a8239af61
SHA512 de72e780093390de1e184eb1cd1f29908fa6e5e100cf49a698ae67d4561ee17ba3e1af4f1a74237a4ed5ef14589791d4ed0e522e662faf2e00a580e1f299cbd3
SSDEEP 384:cgSrmXAixJODd7YkfwjGHDBPBsuQnPY7Yast17SXRargsZGmDLYjUpdMp9oDrUvP:cKXl4sZTDK9oDO
TLSH
T11243737637F4BC9B8BCC034B5D02EC6C45AF94B784A8668C9BD790E89548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4876	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314678984285154"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{C8A10F64-F2B1-494E-9818-F3B8F3B8366A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2228	1288	iexplore.exe	89
PID 2228 wrote to memory of 5408	2228	msedge.exe	90
PID 2228 wrote to memory of 1964	2228	msedge.exe	92
PID 2228 wrote to memory of 4876	2228	msedge.exe	93
PID 2228 wrote to memory of 3472	2228	msedge.exe	94
PID 2228 wrote to memory of 1964	2228	msedge.exe	92
PID 2228 wrote to memory of 1964	2228	msedge.exe	92
PID 2228 wrote to memory of 3472	2228	msedge.exe	94
PID 2228 wrote to memory of 1908	2228	msedge.exe	95
PID 2228 wrote to memory of 1676	2228	msedge.exe	96
PID 2228 wrote to memory of 1908	2228	msedge.exe	95
PID 2228 wrote to memory of 1908	2228	msedge.exe	95
PID 2228 wrote to memory of 1676	2228	msedge.exe	96
PID 2228 wrote to memory of 1676	2228	msedge.exe	96
PID 2228 wrote to memory of 2092	2228	msedge.exe	97
PID 2228 wrote to memory of 2092	2228	msedge.exe	97
PID 2228 wrote to memory of 2092	2228	msedge.exe	97
PID 2228 wrote to memory of 4240	2228	msedge.exe	98
PID 2228 wrote to memory of 4240	2228	msedge.exe	98
PID 2228 wrote to memory of 4240	2228	msedge.exe	98
PID 2228 wrote to memory of 1404	2228	msedge.exe	100
PID 2228 wrote to memory of 1404	2228	msedge.exe	100
PID 2228 wrote to memory of 5948	2228	msedge.exe	102
PID 2228 wrote to memory of 4416	2228	msedge.exe	101
PID 2228 wrote to memory of 5948	2228	msedge.exe	102
PID 2228 wrote to memory of 4416	2228	msedge.exe	101
PID 2228 wrote to memory of 6008	2228	msedge.exe	104
PID 2228 wrote to memory of 4732	2228	msedge.exe	105
PID 2228 wrote to memory of 4732	2228	msedge.exe	105
PID 2228 wrote to memory of 2568	2228	msedge.exe	106
PID 2228 wrote to memory of 2568	2228	msedge.exe	106
PID 2228 wrote to memory of 4408	2228	msedge.exe	111
PID 2228 wrote to memory of 4568	2228	msedge.exe	112
PID 2228 wrote to memory of 3720	2228	msedge.exe	113
PID 2228 wrote to memory of 1912	2228	msedge.exe	114
PID 2228 wrote to memory of 1912	2228	msedge.exe	114
PID 2228 wrote to memory of 4240	2228	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v18R-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v18R-m4-eM.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x348,0x7ff9c8d6c188,0x7ff9c8d6c194,0x7ff9c8d6c1a0
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,9600038649204927288,12442537909740120512,262144 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,2835941448956472432,4708901925693982021,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,17981412170265931880,13103460481713817236,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:13
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,14095789724477252086,8576696216108050845,2097152 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,17809854685353022607,826147790379289577,2097152 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4582468382733668344,13101819544538762185,2097152 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11677660416044146643,1520136841336922779,2097152 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,7737627448355571709,16127269180446276490,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,10060310273400986632,2466568562145187153,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,14671670592199068722,13622410676434292605,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3410157538127542224,11518915139481012923,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,3410157538127542224,11518915139481012923,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,17881049705310309816,10395112254625690564,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,14226548551099175270,7519382045316696674,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,8679309914075037858,17788162802412720029,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,5629357401864841515,11949839206428639350,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,1331298710617484647,14659827662658510414,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,15951394728061399341,1531618121721178248,524288 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5612,i,7723522451981597366,10329890234937960811,262144 --field-trial-handle=2488,i,2527114353613286455,11944834227817430068,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ff926e4ab965c75076a0b76dbd6af66dc544adbfcf1eba12ccb538a29ec26a57
MD5 286d9a0d1280ef66514789e718b33879
SHA1 541a9ec3ae644abd6e9a9ad14e12da51d75c4974
SHA512 cfb49ccc5911e075087c19a150a8b981d62dd06a867382123f306fe77bbfde2b737333de517fed8fe0f14005d9104bfab67b2470d02c7107b44ba60f2f095855
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1ACB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 05c3482ecd99e091bb4db31c307ed9b68101b8b5a3ce1af38bb2620c210d9baf
MD5 de334ebb5af2f7556a0bdebe102f88d1
SHA1 dd275803f3056e97a3617d3598853292ec018b76
SHA512 d0d23812de9d15d343bb621d7d9948437ac5ae3fe8c09e35fa30050092346ee6d1ed2fc691e44b189e13d29b8b8327e324fcc3343589ca1c2f6eaef1abb709db
TLSH
T11641095413B60ADEFBA4D6F36FD27E9932B8D8F9080F2F9048D1A2F13E057241152761
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d334.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d334.TMP
Size 2KB
SHA256 c60a39ad1ad4281601e82ccc023505bbd90b707e8d1e2349c05fa392186569ed
MD5 b629959e90aadeb5873487cffe2b8978
SHA1 a1afc82a47704efc7732e03f1df433d10b6635d6
SHA512 6381f34c88e540fad965be0200a5a148d3781dd9358bfe1777951ccbe6b2ce5eeee63e391914a3e0b349e82f8790078fbc757319f5c5474d89605abb7a47c24e
TLSH
T15541F85413B60ACDFBA4D9F36FE27E9932B8D8F9080F2F9048D5A6F13E057241552361
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ea18314600b53755b7cd861c37f64166ccf70b4159013df7b2105c4abb3bab2d
MD5 47d2a5b1ff883e2bb7a3d14182b324e3
SHA1 f59baac3e6d62bba638a27745890f843dfad1a47
SHA512 7a2df3680526f3fc983614e5728113489990c1c736dd5bb358e26d0a024bbd8d1621251a5ad95cf01a5f0fecd91ac2cce005c8f3a4645bcd09493030e0ff6a26
TLSH
T1D5419EF783F4856E9A0196F0AA146F1FCE1C0515832C7D5AC9E4AF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 409f0c42988005fdb586ab12f5c5f8ea5b584d9e44d2fdb8a1935aa5c955bf1d
MD5 bfb5d7ae6b9c25a4f4fe10bfa8aab94a
SHA1 e3c15796cc48ed7d97a98b04da138bd86e4ca3eb
SHA512 0b1f736c4fd70b1fc036b30f7a1d8c64429e5e783b084223fc12975fd78d908b48aec937e17e4692a2ebe367c85d59183e72a13dfe72e22befd5087689e8e847
SSDEEP 192:sxRXR5yM/jK1Ml8wCT/fvgsEllTNZq1B4Y6zoA8p4T/g6+WNIYEgqZcGX6IgV8J:sxRXX8T/fIsEnTjVye/5IZSC
TLSH
T18062E905AA389D778CDBD20DFA557F53D6F81573A2905E44AAFCCA1C00E6AED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 896fc9e18130c0c9c4f04da823cbc7cab6590895d0102ea25049df81245b8497
MD5 719daf8a5c98250b1e66f877ca99a3ea
SHA1 771689aa160960490cf4b605f884cdd5a3cd34dd
SHA512 564c6fbed4b91ae44a7e69a5363d6ae7576daa551cc04ffdae680d582d56b035f5ad43caff169dfa4d05adf0232c8190ded13179f8206e64bc5bfc79134e3786
SSDEEP 192:sxRER5yM/jK1Ml8UQRCT/fvgs5ll9NNZq1B4Y6zoA8peT/g6+WNIYEL80cGX6Igk:sxREXqIT/fIs5n9NjVyQ/5IdSk
TLSH
T1DB62E805AA3899779CDBE20DFA517F53D6F81573A2901E44AAFCCA1C00E7AED611381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 99de245008e39c86857a1de1174e20dbf16bd92e8c20dea4af2b3e1e9d849128
MD5 02b814b41e12be2f25cd4cb3a508580d
SHA1 566ded66eeef8c094aa8c30cd3aba9e8d5d0b10f
SHA512 8267b71bc85a89e255fc4b4001dea5be72a056ea91dab12c5e574d7a40af5f0396d39c20e15e8cedeb4a3b8e81e24cfb4a1d28787cb23148b6cf279264115f17
SSDEEP 192:sxRER5yM/jK1Ml8wCT/fvgs5llTNZq1B4Y6zoA8p4T/g6+WNIYEgqZcGX6IgDF8J:sxREX8T/fIs5nTjVye/5IZSe
TLSH
T10462E905AA3899778CDBD20DFA517F53D6F81573A2901E44AAFCDA1C00E6BED611382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7e7e662b38dcc666336726030827c96524a87e0187a0b40b94b916703366bd04
MD5 dc353f2b91237280071d8a18197e8307
SHA1 45ffe450dcf7adcc1054edc5348f3b0fcfc50cdf
SHA512 e08488b62c08ee9d980a872f730b8586f788275c3090a6fd0d5870411c75a59cbb54f3cd285862fdf61c405c64291fa2ef9b87842be8bfa175a0d56b995f6370
SSDEEP 768:40D76DrQD82F7pLuL7J0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdb:40D76DrQD82TE7J0DbWgQ6DjfPQDFu1r
TLSH
T17DE2EC3B680CCB7F4F8049DCAD29BDCA6DE801CB56D8899447EA880C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4e3a81cd2e3fabf00a00a048cec5026b3188e035e25cbeea1154fc5531dd53a4
MD5 316bc7caa22e56785f6809dd9cd1b4cb
SHA1 b4aabfeb1c073dbfc4dc6ae155bf4c87f48a0e98
SHA512 27f8f889b64cda20d7481234da176740a4b1dea1cbc234e2016725bc51aa960977252b9d03363c2c62b6c89b6c1520e5df770734df533069db7b7dc6edbdf314
SSDEEP 96:KRWLa2Q44eWIdFgWeK4rgEec+W10m/HFSr/VPTXWbAOgHXK42gZXc9lYrWgQKp2R:CWLa2Q445IdGWWrgEN+W10m/HFSr/VPS
TLSH
T17E913081367B52C03C7E699C85B8851B828171F33208F93B77A851A24FA7E425DFF5CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c9fb17709d9f8dfb1322861c947cdf4c3a15d0841929ca046205aeaadef47677
MD5 bbc288a82b9757dd8881090e9ecb49cb
SHA1 5b770f2eafc768d3c16c6286d275fd54ed490177
SHA512 1799006275931b281612b103f0b35b9bfd337ed65438b5867e7cbd3e5d2ef85f23cdd6ac52e5b19973c8243548dd327e42f5893c185788a68c1db183dce3ecc1
SSDEEP 768:drv+4UNbdG34kPDTd+ZN21fXeX6+qTko0u229a4vsSyeVH1SdW:dbsbU3oIxmvVTVKa4EEH1h
TLSH
T1A303BE32E8698D334DE69688714B71972FB92173CAC80F54D9EDAB0D064B65C270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 be2223bff64b973d304efedfad91ea0fcf03a0f08a1f5fd9af1c114bf22b432f
MD5 baa89664e37e5aa340a072d00981f2a4
SHA1 86732f2a19bfc8ffa8de0915794688f6445906cb
SHA512 ad711a05eff392bc90fa663a2bf52777926c42f278df9250b57e4307a560f33dc0e7ca73b028b8c9f51320697ecb0cde2624cf41ee50ce7e959db368915e01a2
SSDEEP 768:QE3cm+DqIJZN21fheX6+qTko0u229a4vsTyPi9PyM:QE3aIxwvVTVKa4HPW
TLSH
T18F03BF71E8659D638CFAE7C8735632836EB42173EAC41B44D9DDEA0C058766D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3f49684f2f149c13447b1afbcfe9fdc76e8c9110854b310daea513d3337e8b89
MD5 d30b791b4e6a7011e215cb75fa4cd6dd
SHA1 b507e33722cfa6f8d1b0567d35ce2777ddb7ecb4
SHA512 70977b6bfcce154647df1a1f98d540614a309b3555e3c7766b8e526b8194b0b752fa3a7895ce7d69afb3003038af482361547b40639fbfb235b0f10ecfedc7d7
SSDEEP 768:tH3cmVDTd+ZN21fseX6+qTko0u229a4vsTyPi9PyM:tH3GIx7vVTVKa4HPW
TLSH
T122F2BF71E8659D634CFAE788735622836EB52173EAC41F44D9EDEB0C058762D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 da5bd4bb0d32b5f82361796c58bb38f56719ed20f448f4f2c5a9e8bb1170983f
MD5 8cc0a1a80d867a2698f73f7885f2d3bb
SHA1 0b311add619d23fc4e9caa373d150ce1309ee389
SHA512 7cba2323a0a52093892d2256c9fd352123074eee658b8cef98296a57db795f144e88b76dc2ebe1ae1f71e5680be2d147abe464d4b292459747f81bd627a5752a
SSDEEP 768:YH3vxVDTd+ZN21fseX6+qTko0u229a4vsTyPi9PyM:YH34Ix7vVTVKa4HPW
TLSH
T143F2BF71E8659D634CFAE788735622836EB52173EAC41F44D9EDEB0C058762D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a5533e87b052f173599cd80285f7548aef40edc39ae53c0dc6c0eb02a7865399
MD5 8a769d6ee95634db9c8f82f9533cf598
SHA1 90fcae5dc2dd451ea1037bb176baae5bc7054f79
SHA512 c0d24a2d91f8c095b1f41da074fb19ba35e93ff03adb7c33fd0596085b364755ff0aa8bead506fdcc00c2befa5a97bc9354a3c10e4e6fff33e8c1e0fa103d725
SSDEEP 768:prv+4UNbdG3Qy8DTd+ZN2reX6+qTko0u229a4vsD+eVH1SdW:pbsbU3/IavVTVKa4zEH1h
TLSH
T11403BE32E8B589778DE697C8724B71472EB95163C7C80B90D8ED6B0D068B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56ab1ab8-248d-414f-9096-cd55d043ff48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\56ab1ab8-248d-414f-9096-cd55d043ff48.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2228_50586267\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download