3b57fea1eec2d03a39c344332db1a425f7e728e0bcf2afafd5f90352bfa4e14a

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v16P-m2-eQ.svg
Size 48KB
Sample260820-dp7e4sdr6w
SHA256 3b57fea1eec2d03a39c344332db1a425f7e728e0bcf2afafd5f90352bfa4e14a
MD5 36e987192c44bf8a98cc83525c6860ab
SHA1 c2bbafef0aa4819ca038878ed030e235bf20353e
SHA512 51b10e0979e1185dd44631fa0e92cb6839b417135169b8d23b95268775147c7b87cb47a12307570476a595a81167526992f137c9009e50d73a3e1d80080f7f73
SSDEEP 384:cl1tz67bJ/MErSDkAPI9Fs0NsHJCixiIX1dkWs4Cl9sRCOWnCAX+3utANO:cDtimp7s4k9sySO
TLSH
T1202350B537F47C9B8BCC034B5D42EC6C45AF94B784986A8C9BC790E8A548368F7EC590
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316691372924391"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{8E9B5140-1DF6-4FED-8A66-1066FB54C367}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5576	msedge.exe
5576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4392	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4392	3416	iexplore.exe	88
PID 4392 wrote to memory of 5016	4392	msedge.exe	89
PID 4392 wrote to memory of 4408	4392	msedge.exe	91
PID 4392 wrote to memory of 5888	4392	msedge.exe	92
PID 4392 wrote to memory of 5888	4392	msedge.exe	92
PID 4392 wrote to memory of 5888	4392	msedge.exe	92
PID 4392 wrote to memory of 4776	4392	msedge.exe	93
PID 4392 wrote to memory of 4776	4392	msedge.exe	93
PID 4392 wrote to memory of 4636	4392	msedge.exe	94
PID 4392 wrote to memory of 4636	4392	msedge.exe	94
PID 4392 wrote to memory of 4636	4392	msedge.exe	94
PID 4392 wrote to memory of 4496	4392	msedge.exe	95
PID 4392 wrote to memory of 4496	4392	msedge.exe	95
PID 4392 wrote to memory of 4496	4392	msedge.exe	95
PID 4392 wrote to memory of 4500	4392	msedge.exe	96
PID 4392 wrote to memory of 4500	4392	msedge.exe	96
PID 4392 wrote to memory of 4500	4392	msedge.exe	96
PID 4392 wrote to memory of 5796	4392	msedge.exe	97
PID 4392 wrote to memory of 5796	4392	msedge.exe	97
PID 4392 wrote to memory of 5796	4392	msedge.exe	97
PID 4392 wrote to memory of 2752	4392	msedge.exe	98
PID 4392 wrote to memory of 2752	4392	msedge.exe	98
PID 4392 wrote to memory of 4128	4392	msedge.exe	100
PID 4392 wrote to memory of 3380	4392	msedge.exe	101
PID 4392 wrote to memory of 4128	4392	msedge.exe	100
PID 4392 wrote to memory of 3380	4392	msedge.exe	101
PID 4392 wrote to memory of 1524	4392	msedge.exe	103
PID 4392 wrote to memory of 3428	4392	msedge.exe	104
PID 4392 wrote to memory of 3428	4392	msedge.exe	104
PID 4392 wrote to memory of 4088	4392	msedge.exe	105
PID 4392 wrote to memory of 4088	4392	msedge.exe	105
PID 4392 wrote to memory of 2756	4392	msedge.exe	110
PID 4392 wrote to memory of 2488	4392	msedge.exe	111
PID 4392 wrote to memory of 1408	4392	msedge.exe	112
PID 4392 wrote to memory of 996	4392	msedge.exe	113
PID 4392 wrote to memory of 996	4392	msedge.exe	113
PID 4392 wrote to memory of 5576	4392	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v16P-m2-eQ.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v16P-m2-eQ.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd2baac188,0x7ffd2baac194,0x7ffd2baac1a0
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,7903525061632478277,14479293218533598483,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,14398142682111808839,9131381103388910263,262144 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,6252902813189009835,3304697358446205514,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,594535586744691379,15157449587243808455,2097152 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,6373164848939747170,15826451984881012063,2097152 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9104867654209818064,868211858103749142,2097152 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,803840238827820514,10384763183392292461,2097152 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,7538932445120913041,11207391188529850698,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,3244564473484298359,4967779981862268485,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,14941557192036877104,16308477445363466657,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,9734826569745625677,17153087565800786111,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,9734826569745625677,17153087565800786111,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,232541467945320397,4329291014617083852,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7147143903184585701,15508518308937957923,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,13230513921835622662,6339008621871662145,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,9666857317836222704,14207485760806914688,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,5413759197094563343,4046922180836922261,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14762095789305916893,3903330196680330954,524288 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,5831396120492307963,17516280322608860025,262144 --field-trial-handle=2492,i,2474881361774516322,7625306342096997105,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8247aeca7b33f283e40bb306bc0f5d3f9484f29ba499d4fef16adb4f524d067c
MD5 b27475a4adc7a441cfbd4e10636bebca
SHA1 128cd1ea190d0ec80228a1924b99cc6fe4d9e60c
SHA512 0f3a31480c4406c56e8db918a4bf77c6ff4f86841313f82c28703b2711e4ea7b4057b1278f6ec66772d1887ce88d74f882ece97b27c07f9de109017c91044366
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7F:fwUQC5VwBIiElEd2K57P7F
TLSH
T16DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 edf2e5f456ad561ccf81b760746a85c46cfcf00ea9bfbbc7bd9293c7ea2e3dfa
MD5 e462e13a1bacece152c069863de20875
SHA1 3cb8754007bd494b5322ccacb58417d261040cc9
SHA512 151fc8a8d7abe56707fe7859f53a150f510a8989e4cb0d8ca6f5bc8c8d55e82d3821ec4d028e5fbb120489d952b296cdb6e99c6a897b97cfc4ccddc691af66e9
TLSH
T1AA51DB5D0B6CDDFDC722A8B660E040C93EFB8C7401435F1203FAE974090EFA82310211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ee1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ee1f.TMP
Size 2KB
SHA256 c63b56a01fdedbc7647bc202446ec4814f26e225137d687c234987ec71757272
MD5 0e367b3072428d450ed29dabef12ff9d
SHA1 835579f629a9dcfbafdf28743b48f6d74f64ac75
SHA512 df419d9171a5f2e3f476a1d281a9b4fbf6057822c02ac41b471a553e66c218c9e00dab8834294e154e18214b15cbcf85c748bd5d6727b4bde5a9b4ae8bfa39ce
TLSH
T10E51C95D5B6CDDFDC722A8B664E040D93EFB8CB905875F1202FAEA78494EFA82311211
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 69e76ab492110d00ff9c3b5570eb7f844619567b59fc14dfc3177ce00c1c3e76
MD5 3c08c54639f14c88ccc6e1b7b6730cd2
SHA1 f3567033ea4176bc8dde05920a1130eac9e3a362
SHA512 553c5b0458278cbb6bbb288af4a713f7b432ac4e1bfcb6012e27fe9358db881877b42ef449527919e7e37d3fdbd2848e7d42359cfb5aa1383219e1c0b032f35b
TLSH
T15E417FF783F4856E890196F0AB186E1FCE2D0915831C7D5A89E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 12665337f15316b749589665d36fc9e7258932e2f819611286c75ef4d210c6a0
MD5 0b10f60e0c0323a77de5bb7200ad594e
SHA1 77d0a18dc06630ac7aa091becf0a1b0459454eba
SHA512 8784db284bf798359d8730c744242b198fc1c2089072c9492e219167be425c23d41626b1fa8982648340747ad99778da34d48d5a58da63636b397a733ad2de43
SSDEEP 192:sxRnRvyM/jK1Ml8wCX/fZsXNwGZtx7bAzoA8p4S/g6+WNIYZ7PqYV6GVIgVVJ:sxRn58X/fZsX2wv5b/5I0Lp
TLSH
T1B562D9056A34997BCCDBD20CFA557F53D6F92423A2901E44AAFC8A0C00E6ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 12e0373306ebfa72703f86d06a89039f2bdb8c5fc54071bacbc74489451f3b94
MD5 07b897f0314c7c3cf00baaa3e35b6449
SHA1 286145a272988584e35687c9fc660b7fcf791e07
SHA512 33233973b6882ce06df515879e557cf9dfb6b328f2b86c941a8694ca0f43bbe0db8e3954bff32d066a83872f0a3f90926ccfb7939506fcaf371ac3c915dc44e6
SSDEEP 192:sxRcRvyM/jK1Ml8wCX/fZsVNwGZtx7bAzoA8p4S/g6+WNIYZ7PqYV6GVIgDCVJ:sxRc58X/fZsV2wv5b/5I0LA
TLSH
T19E62D905AA34997BCCDBD21CFA517F53D7F9246392901E44AEFC8A1C00E66DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 edfd83e939e63b8203f3399f6bc5732141d6c60f3a4a4d7aa4e74238dcccd1a9
MD5 e84eebab9165fd90a9788137f7d44287
SHA1 210ce1591ebd15bc7246f2bd14d0206789022ef1
SHA512 b7b7e27086e56cf8346335e5e3daded28ee1d8d990512c18fc5f12754715483aea40844318e62955252fd7323d66f4c8ab798d1552e0c1eee509405621f88704
SSDEEP 192:sxRcRvyM/jK1Ml8UQnCX/fZsVawGZtx7bAzoA8peS/g6+WNIYZ7PCg46GVIgDYVJ:sxRc5qCX/fZsVxwv5B/5IRLi
TLSH
T1AF62D815AA34997BDCDBD21DFA517F53D3F9246392901E44AAFC8A0C00E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c029c1ac9a4d20df8a56532afd564dd46bc5e36647ea572e12a8dd39b8afca55
MD5 849ebe24f8bcb9228939e2b16690de16
SHA1 68ad82e590c5064dca4bddb04ebd74aee6ac75e6
SHA512 b3d1b973e431d505a9ff07d16f1c5cd67ab4e1f00170d5093fa32e7ff53619c0b36067b776d5f785084d1fd0503f1119a15378748f2e751bc78dbfedcc9340d0
SSDEEP 768:kfIS9S7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuttSV2yroHh0Il:kfIS9qE7CvWgd5fWbu1ja9ttU2pHh0Il
TLSH
T1ABE2DC3B680CCB7F4F8049DCEC297E9EADA801CB96D8C99447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 37fe28eafc84d4ec535e7a16c839d59d88bcf94a805f77cc4768f3cbcee910af
MD5 e5ff823b8a12592e98f0a757ab3bec55
SHA1 4bc8c7794d7d048d6e663cca344467331fc52f67
SHA512 bfe0146f79beadfd31a71313eed3f66d0063d386b093621416908d9eb79f9ea53a739815a8a8f9289d9278e08a27fc0ba43b3afeeb03a595a362d750dd53933a
SSDEEP 24:KSiomEioOiovio7PiooSiopioliok1iopiooDioPI4ioDiokKXioHhPioFiok1Rp:KcuI/KvK0jyJ8IjKN6c1HIFK08A/yu
TLSH
T107917781B1BD52413C7E694981B2C56696D5B0B3343CA47BBB9900B20FA6F118FFDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae0d6dd4-abdc-4f5b-a5d9-505f7e1b3d80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ae0d6dd4-abdc-4f5b-a5d9-505f7e1b3d80.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6fe4cd9c4ffb7dcb6c1e651eace5da65005278b74d7ed7c7087858a285433904
MD5 19ba205d519e57b834e4665c64735a2f
SHA1 fe215e9353511e7e048f3b11cb1aaf3c7ed18b20
SHA512 51b07d70b7e473fc0fc5b43f5c2efa1dd5b8e349d9436b8e89aaa71a7776862e2c6f783a1e1e097fcd656f649f4d3b9bb31173c68aa7829b8112c455cf5494e7
SSDEEP 768:wFQS23BwgiYFeLHL9Aam6aQMGdjWca4Ghf95DnX:jL3amaME6p9X
TLSH
T1B2F25C31DCA4C97BACA7A7D5B71A7687EEF0216388DC8DC4DAD95E0D019319E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 72e7f281af323caa4e430f51b28aa4fe87586311ecf74d4dfb26dd542dcd5ea7
MD5 075b41404ec5f533c11f3d1fd1c701ef
SHA1 98d298c7e7b80afc41db44e1b9dd251c3588ed27
SHA512 a0bb918059c7dd120f769edec7a3a5e97fa99af5567a8c204be79abf2cfb0df95ea5af8302e69bc9cae4b9b054a6fd802df4c2dab51a3ae37b905e8d2ed2054e
SSDEEP 768:YI3IYhqsLHLPzAam6aQMGdjWca4Ghf95DnX:YI39VmaME6p9X
TLSH
T143E29E315CA89C779CA7B295B72A2787BFF0217388DC4D44D9E96B0D029318E271BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 67a8ae6f7bb5351dc715d581e35bba410dc300713ed3a3c39b4d958329dd2bb2
MD5 661530e07199c5cde01a625b13a21b33
SHA1 06b27030e0ef5466f2a5bc43915bc88961ced00c
SHA512 eca1c82f7c706fcb878a45a0126869b28aee5b0b1b0b0574d64ab5082f5e1db8dbc35f657736622d07945735bdc879101dd99a6cd10770dfee9cf58e6ada5b70
SSDEEP 768:/rv+4UNbdq30GqsLwAAam6aQMGdjWca4GhfB5tPeU/:/bsbc3EKmaME6pPH
TLSH
T123F2AE31A8689973DDB79A99F21B6787BFF021A384D40A84D9D92B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2f72074f81d44a19532e620dd7787c3e7d516871d031068b2bf4bc59fa3aff30
MD5 b1e76f19dc8716958b6d69a51cbc9866
SHA1 53dde0b25d0e48d9a0eeb002f130c0626477488b
SHA512 c17032caa9f6b6701297320c2971961a0fbd65068ff9d4accf2722f4cccf7c3eaacacd02a9f5075cd2137159084e879a1625e05673b04f8980ccf94f8fe52bf3
SSDEEP 768:vrv+4UNbdq3gvqsLHLP0Aam6aQMGdjWca4Ghfw5DPeU/:vbsbc3cWmaME6p6H
TLSH
T11BF2AF31A86CD9739DB7A294F25B6687BFB021B388C40E84D9D56B0D029718E330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 f7abc5ee70705a573a53ba6d9e5db5478235353971f8883e3332ddebfcb60dcd
MD5 1dea417fadb951f4498ff2fac501be51
SHA1 80e1f2c6615990226bd3a98c44a2df98e4d2ea72
SHA512 74dedb444370e8818151cf16bbded4c80a55d7d62ef7bf175388109a85f6df818b163abe6259f3770c2ce8e9d7116a32644b292bd9d97721972df0360f3c17a6
SSDEEP 768:Wrv+4UNbdX32ghqsLHLPzAam6aQMGdjWca4Ghf95D0/:Wbsbl3rVmaME6p9C
TLSH
T1F703AF31A86CD9779CB7A1A5F21B7687BFB0217388C80D84D9D95B0D429718E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 522B
SHA256 532e27b1c35cecf3833a063deb0a05850d18f45002890d4dd9c69509841b7738
MD5 b809bb2b4dca57c6dcf6e141ab343c71
SHA1 3d858fed3e81f1ca3d3c105aaa579c0359654edf
SHA512 089d37cbd8d0d641052a8ffbbf4ee41489551f876cafb2dec05897f131d309580b9872e3493f6cec359efde76d766ef4a7f8ee86fa084740fbcbd049e7f749e6
TLSH
T177F0051380DA34D2EA6B00A0F1446DD4120FA1FA2919B7746975855681986716144736
MD5 SHA1 SHA512 TLSH

Submit Download

3c638a23-f883-40d3-905e-37b6f407fa78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3c638a23-f883-40d3-905e-37b6f407fa78.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4392_2133072962\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download