61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260819-wcbf1ssset
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316351810847603"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{B02F0323-3F6C-4A4B-AB47-8CCBC8502FC0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
716	msedge.exe
716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
824	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 824	1968	iexplore.exe	88
PID 824 wrote to memory of 6020	824	msedge.exe	89
PID 824 wrote to memory of 3136	824	msedge.exe	91
PID 824 wrote to memory of 4452	824	msedge.exe	92
PID 824 wrote to memory of 3136	824	msedge.exe	91
PID 824 wrote to memory of 3136	824	msedge.exe	91
PID 824 wrote to memory of 4868	824	msedge.exe	93
PID 824 wrote to memory of 4868	824	msedge.exe	93
PID 824 wrote to memory of 764	824	msedge.exe	94
PID 824 wrote to memory of 764	824	msedge.exe	94
PID 824 wrote to memory of 764	824	msedge.exe	94
PID 824 wrote to memory of 1252	824	msedge.exe	95
PID 824 wrote to memory of 1252	824	msedge.exe	95
PID 824 wrote to memory of 1252	824	msedge.exe	95
PID 824 wrote to memory of 6052	824	msedge.exe	96
PID 824 wrote to memory of 6052	824	msedge.exe	96
PID 824 wrote to memory of 6052	824	msedge.exe	96
PID 824 wrote to memory of 4608	824	msedge.exe	97
PID 824 wrote to memory of 4608	824	msedge.exe	97
PID 824 wrote to memory of 4608	824	msedge.exe	97
PID 824 wrote to memory of 3248	824	msedge.exe	98
PID 824 wrote to memory of 3248	824	msedge.exe	98
PID 824 wrote to memory of 3600	824	msedge.exe	101
PID 824 wrote to memory of 1284	824	msedge.exe	100
PID 824 wrote to memory of 3600	824	msedge.exe	101
PID 824 wrote to memory of 1284	824	msedge.exe	100
PID 824 wrote to memory of 4312	824	msedge.exe	103
PID 824 wrote to memory of 4268	824	msedge.exe	104
PID 824 wrote to memory of 4268	824	msedge.exe	104
PID 824 wrote to memory of 5432	824	msedge.exe	107
PID 824 wrote to memory of 5432	824	msedge.exe	107
PID 824 wrote to memory of 3612	824	msedge.exe	110
PID 824 wrote to memory of 2200	824	msedge.exe	111
PID 824 wrote to memory of 1672	824	msedge.exe	112
PID 824 wrote to memory of 444	824	msedge.exe	113
PID 824 wrote to memory of 444	824	msedge.exe	113
PID 824 wrote to memory of 716	824	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb09ddc188,0x7ffb09ddc194,0x7ffb09ddc1a0
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,9194878675268618219,7736857825049486852,262144 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,11677579823499516509,14923358106863369311,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,17894786754288117196,4975083273517111862,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,6430964569961593121,12008575009400443582,2097152 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8817605382942868682,1583198642879014030,2097152 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,609798086180985544,5878060141446077583,2097152 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,14296910514262254341,17282351557004515173,2097152 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,13703875435581627251,13692374813636449491,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,11877136839886459181,17632748448643400752,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,8878141311319767015,16611922818258911614,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,1369479646076960773,179264202093068240,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,1369479646076960773,179264202093068240,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9353197452736772256,6570794857617185240,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1647556919018506934,6370776141938371944,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,3919895633077051405,16498376567531455154,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,12411941318403189487,13075754307192101453,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,15643086099437184949,8638268405257379295,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,7737355133297284177,10052718378646528569,524288 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
    3⤵
    PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6788,i,13153438386867945140,6923607874796977124,262144 --field-trial-handle=2684,i,13888419098806716028,13894552882606004801,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 60f072ed20ea81d31dded90063848c3d97e0e03e1a70ca4e5ae53964d511cc4d
MD5 d2baf8df366dae2dddef46c559f7de74
SHA1 a45b7a24e762425a201edf2840d687ab22b62a7b
SHA512 5ab3fb201d7bb8ac581f96c336b4a434ffcde238ba2877d05db85d1b20c6b956d62d6720a8fe985d2dd511621dd3d400723d5cb009506f6cf2ea3ea9b0f4e011
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0cb51e504610681743afba6dd242eeea0981520ac8d83515e419fc342666cdfd
MD5 2e185e914cad81858500c6bba3bab2bc
SHA1 8cb37461747195bf58e2a54123507c683a20c5a7
SHA512 3d2b487a2e38648bc1c9bf0994add0bcb6b92b674614ba2494a5311b61b12d3ba376b11b5e998e36b3261d6241c3b39470737757daaaccae04157ea67f051c58
TLSH
T162613D6173603DD2EB268AB621FB688971F68C5D3307AB79E380BD759447F8810D21D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c2c8540130710fb706f1f001c18c0c8ffaed54029198572155202f526f629cb2
MD5 153a357e08b0b26ebf00c6975c61fa3a
SHA1 55a1f56a898e75d5f14f26dbf4bfe5d1ea1892e2
SHA512 203ebad0de0f6479c862167a9ed9e0d8072d48635f0473052e2e5ab8a916e807027c9e0ebf32eb62204ca32bf47de7900d751494f6425ae75f76bc1d2029d713
TLSH
T10D41B0F383F4957D8A0156F0AA146E2FCE2C0911432C7D5AC9E4AF2B93E3471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6c3c8cdf540c56ba4e4a939a1517cb88d60d8f82781b7c6b9338e8dbbadca2fa
MD5 36c216abbdaa78f42bb557c81199f409
SHA1 e48b3a77e4c3856415821737762c0270652bd7bc
SHA512 c93cb58da1554a4c2c7867850feaf0b857fdee08351fd437c24484ad6c94b67a8bfa0648c0e8297b6b7a4413c7abd3d2fce5cbf0e5e1c8aa52ffcb7d90414650
SSDEEP 192:sxR+R1yM/jK1Ml8wCX/fJsEQe8ZrzoA8p4P/g6+WNIYEgC14+GnlIgVosJ:sxR+n8X/fJsEQeCK6/5IB4TyQ
TLSH
T13D62D905AE24597B8CDBD20DFA557F93D7F91433A2905E44AAFC8A1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5f4e331e2efeef6bb607d1babbe19604c682d24460e3cee958f21cfa929c08ce
MD5 fb122bd0b8329a422208b40f70513651
SHA1 1ad430a5704a720677cf511999c943cf86ce9a57
SHA512 003a7be9ebb3ce2b66416c21eafbbcf4a96a2d02247bc1e70dc44fdc6358abef60b16f0a634ca29652d0e63bfbe93b1ed71de524aee31de66557c87334f98d5b
SSDEEP 192:sxR1R1yM/jK1Ml8UQyCX/fJsQte8ZrzoA8peP/g6+WNIYEuEu4+GnlIgDGosJ:sxR1nqFX/fJsQteCK0/5I04T3Q
TLSH
T11862D705AE2459778CDBD20DFA55BF93D7F91433A1901E44AAFC8A1C10E6BED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 270c11e249937c2bb47ceddca7cf082925bf6617e29da06f9e9169d8a97fb62a
MD5 fd76de63b5ab1b1d65803ce9bd7770d7
SHA1 c196383cc2ec81ec8ec3af2f54940ca4f424a07c
SHA512 a42ba119600056a1156fb1d619236e1bee99c7155f3a3438a4afd235b386e91c26e50781f90f7078b7e6a52d2493ab083063b85a42d95b76e214e837d9cd6f66
SSDEEP 192:sxR1R1yM/jK1Ml8wCX/fJsQQe8ZrzoA8p4P/g6+WNIYEgC14+GnlIgDkosJ:sxR1n8X/fJsQQeCK6/5IB4TBQ
TLSH
T12962EA05AE24597B8CDBD20DFA557F93D7F91433A2905E44A9FC8A1C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7e3f700dd2948c465cb20f1a59379ff4f9b36d335e5f2bf2ebf3230acf5f7c36
MD5 6bd0f86c477d9d654bd9fbc7bf814df4
SHA1 aa9d1a7163e23937688556479498db4d8ee89843
SHA512 a75ef15be17a6cb95aa96b26e005dda150ba454ebd5cd9076aa5084116ecfdead46cc03b238c529beadfd7729be07abe34c09655c191d28ab7332e2cff6ee382
SSDEEP 768:40D76DrQD8KF7pLuL7J0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHl:40D76DrQD8KTE7J0DbWgQ6DjfPQDFu1D
TLSH
T19FE2EC3B680CCB7F4F404ADCEC29BDDA6DA801CB56D8899447EA881C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bcaf7ca9e861d9906ad158d9a477086574b373ff48a8fa1d98b78736067bea61
MD5 383457b5d9f4b5b932d17baac38be69d
SHA1 57dd92f6332d119873f14fea6ff6eb00d6ea74c1
SHA512 1177063a55553827dae7d703209ef808742b4dd772837b639a973d5c9ec3726a91c82be97244379b36fdd3b7af165a20f874cd2b2571d5306e43c6cc006c6004
SSDEEP 96:KRyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHeTieYgQGWAltgeGK4DgcGcW+9MJIgKlWp:CyX+SkE0tcJCCqXg4ZCqRwSbHeTieYgz
TLSH
T18A916F0835BA42507CBF6A6D817DCD6B868174733609E83B77A819A30B67E025DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 375cc0fc644cd028a20957478c1000b275ca6500deef3f807f8c30e229b474eb
MD5 ef1beb8906ec0c6b7f7018097b7f4405
SHA1 e18cf4cc42d1022259605218aa68d382602eec18
SHA512 d8ed5a8e08698137614a5d911cf64aad73097053cc19e8a19b7bf8f98bba2937f0175f79647020952e533d6164e91fe74c4d5b1ed1a9c9b111a5d14309946858
SSDEEP 768:xF3i4BOGDRt4HZ/oIDeX6+qTko0u229a4vsTifcN:xF3EgvVTVKa43fcN
TLSH
T100F2AE31FC759D7348AAD2C4B2177687AFB41073C6C81E8899EDAB1D150766D2B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 463c7091e9325b65c4fca00118330b85b0d46a0abe7fc5901ddc657ed6ac2668
MD5 bdd1e8cadf5a08a27c53c9d5eef9abc6
SHA1 a5aef26b9f232cf827df8773e0a9815e8309e46d
SHA512 71553a439810c229df62536a1205f433093b793472ffa085a5799112c599d6f7ad43c379a93f9f45b5faab5a27f367b78cb1071938f3fb2b0db3d7728b98d974
SSDEEP 768:u03p4BBDTd+Z/oIReX6+qTko0u229a4vsTifcN:u03ZevVTVKa43fcN
TLSH
T199F2BF31FC759D7348EAD284B257368B6FB41073CAC82E8499EDEB1D114765C2B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5a9c31c3209088d8b4f623e1df1decf3876d8047de9d66dd2eb9a080348c5ecb
MD5 78dcab9c698caa15428889d103070ffe
SHA1 c3a56adf710b4c073b7e2189ad33d4fccb53342f
SHA512 a4cc64af954a0291572a5e0b2fd75357c8209e8fc1d2f17edac81b1f28d2d334afd7a0b3df839ad04c5a2ad96a69d624729439eacc9e681c8da6a6e9abff11c3
SSDEEP 768:h03i4BBDTd+Z/oIReX6+qTko0u229a4vsTifcN:h036evVTVKa43fcN
TLSH
T13CF2BF31FC759D7348EAD284B25736876FB41073CAC82E8499EDEB1D114765D2B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 da169cd10f8129cad5ff1f423adac58b4edf8bbf7a1715d01fd0ac46afc46fe0
MD5 755c28af304655396f394bd534c17ba9
SHA1 793cf72d12a9bf3352360452de7f9efcd5db83a5
SHA512 33ec0f5b9a8c34fff3574ad3b054752092266e0d3d41d0ddd93ff4061b0bebc60f9a3afbfc1967ee7dd75f339c367acac4d9458a8dc50f9cd586f3c91b327312
SSDEEP 768:prv+4UNbdG3xIIDTd+Z/ZeX6+qTko0u229a4vsDXeVH1SdW:pbsbU36QvVTVKa4+EH1h
TLSH
T1B403CF32E8B98A778DE6D784714B35473EB95163C6C80B80D8ED6F0D065B5AC230BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 44b0db4b9aab544913083b629ec62a69e0c4d12cd7cf4fcf5de5acad1bb48cdc
MD5 05c6bb18cd51991cf54159c69f285a95
SHA1 76cf03a99fd5fa8b4145663ab9bb407106fd0200
SHA512 9d615a2c6a0414196edfc24c51540739e0b1d2aff9e6bf9c8995a3b6e93174c170fa42a9253ca1ce7c282a1e6f4cc66158d6120dfc218ce924135e1b80cb29ab
SSDEEP 768:qrv+4UNbdz3l40BDTd+Z/oI4eX6+qTko0u229a4vsTifcW:qbsb13AJvVTVKa43fcW
TLSH
T13313CF31F879DD734CA6D284B21B75877F7420B38AC41E94D9EEAB5C014B19D2B0B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b1f907ef66a0f22c290cffb5b90f5957daef85cc0c9ca122510d34f36ccfc466
MD5 3c01a4cb8dfe07528c0184a6bed7d929
SHA1 1c521483e6e55f5c1fd9eba96e23ca700ebbddd1
SHA512 f36331d3940294456f1d2a2329feb6d6d9126a98c37a3c2897bdee72debecb56db3efc76a3694c9b0b20249f985db2e6d1dc5b5f3f85118419dc37f759888994
SSDEEP 768:5rv+4UNbdG3UH7DTd+Z/oI4eX6+qTko0u229a4vsSieVH1SdW:5bsbU3hJvVTVKa4EEH1h
TLSH
T18603BE32E8799E7349E69284715775873E7821738A840F80D8EEAF4D064B55C270F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

457272aa-cc24-4cc5-a35a-e7c64daf008d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\457272aa-cc24-4cc5-a35a-e7c64daf008d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir824_2096109145\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download