66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m0-eL.svg
Size 3KB
Sample260820-rrv2rayfja
SHA256 66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73
MD5 95b7e2e1d8065db4ac2ce8927e95981e
SHA1 9f303ce03119c2588fcbb4f320794622c61045e5
SHA512 88d142db6604e75c03e021e409b771a60808f39568002c877a1bb39f1dcb57f89da8c819bd1a76d8cb929edd7c1405165884108a2abca02f298c6a497219887b
TLSH
T1E871268876F87EEBD7C802570D51D4B84B2F946BD822978DD3CB90E875282AC735D5B0
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317095785466571"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{11ECD139-7C7C-40AF-AA87-BCDE06D6720C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5128	msedge.exe
5128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4148	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 4148	2592	iexplore.exe	89
PID 4148 wrote to memory of 5756	4148	msedge.exe	90
PID 4148 wrote to memory of 4588	4148	msedge.exe	91
PID 4148 wrote to memory of 1820	4148	msedge.exe	92
PID 4148 wrote to memory of 1820	4148	msedge.exe	92
PID 4148 wrote to memory of 4752	4148	msedge.exe	93
PID 4148 wrote to memory of 4752	4148	msedge.exe	93
PID 4148 wrote to memory of 4752	4148	msedge.exe	93
PID 4148 wrote to memory of 2976	4148	msedge.exe	95
PID 4148 wrote to memory of 2976	4148	msedge.exe	95
PID 4148 wrote to memory of 2976	4148	msedge.exe	95
PID 4148 wrote to memory of 2756	4148	msedge.exe	96
PID 4148 wrote to memory of 2756	4148	msedge.exe	96
PID 4148 wrote to memory of 2756	4148	msedge.exe	96
PID 4148 wrote to memory of 2732	4148	msedge.exe	97
PID 4148 wrote to memory of 2064	4148	msedge.exe	98
PID 4148 wrote to memory of 2732	4148	msedge.exe	97
PID 4148 wrote to memory of 2732	4148	msedge.exe	97
PID 4148 wrote to memory of 2064	4148	msedge.exe	98
PID 4148 wrote to memory of 2064	4148	msedge.exe	98
PID 4148 wrote to memory of 3932	4148	msedge.exe	99
PID 4148 wrote to memory of 3932	4148	msedge.exe	99
PID 4148 wrote to memory of 964	4148	msedge.exe	101
PID 4148 wrote to memory of 3856	4148	msedge.exe	102
PID 4148 wrote to memory of 964	4148	msedge.exe	101
PID 4148 wrote to memory of 3856	4148	msedge.exe	102
PID 4148 wrote to memory of 1728	4148	msedge.exe	104
PID 4148 wrote to memory of 3216	4148	msedge.exe	105
PID 4148 wrote to memory of 3216	4148	msedge.exe	105
PID 4148 wrote to memory of 5880	4148	msedge.exe	106
PID 4148 wrote to memory of 5880	4148	msedge.exe	106
PID 4148 wrote to memory of 4132	4148	msedge.exe	110
PID 4148 wrote to memory of 1900	4148	msedge.exe	111
PID 4148 wrote to memory of 4304	4148	msedge.exe	112
PID 4148 wrote to memory of 5400	4148	msedge.exe	113
PID 4148 wrote to memory of 5400	4148	msedge.exe	113
PID 4148 wrote to memory of 4548	4148	msedge.exe	114
PID 4148 wrote to memory of 4548	4148	msedge.exe	114
PID 4148 wrote to memory of 5188	4148	msedge.exe	116
PID 4148 wrote to memory of 5188	4148	msedge.exe	116
PID 4148 wrote to memory of 5128	4148	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m0-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m0-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff80628c188,0x7ff80628c194,0x7ff80628c1a0
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,7467740098531387618,7736070146495250125,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,10025955259993104425,7545185774396340557,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,8546184281812749688,16829224113783432333,262144 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,7863089940252730680,17179598036059169102,2097152 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,2284770200558838822,7425609845303762470,2097152 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,10969831652871746303,17760705987430097158,2097152 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,4424744846805689210,622729662876060749,2097152 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:9
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,7522812667092347361,4536247114014570214,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,7042660310095210141,12392727587629094221,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17523241226783252398,7945977920787135271,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10994029475828320546,7214268418176805382,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10994029475828320546,7214268418176805382,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10448269695150259834,4549912048853207213,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15555823342865807513,15625700802161091336,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,14428360120568007501,735980480033306678,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,9303884219483502602,4559789311311911879,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,7419460197242279783,17767563137074071089,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4521342290085927717,10776786543944295258,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9460803529885395507,6338277363676534622,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16656410606087105633,651247105629096210,524288 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6272,i,16680045961456790562,11430410863070834962,262144 --field-trial-handle=2252,i,5246959984326019605,11079206697089181699,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 10b37f15cd54eda3f0d60085d091191e6f108eaaf6a099927f8d4e16abf92ccd
MD5 b295e04c9c730ce9a01922ab6f839a17
SHA1 afbb703eeddebd641692e9862e8eecf03f7451ef
SHA512 7449fcc34248172fbac8779712df21cee3dc7477f26f7a7a970090ca8a711fddf5caa2ba1d53af14b558baa9d42e533fa25d1236f98858338ed5c3ff5abd522a
TLSH
T117E026C404CCC2AFE748B487516C530DC2E0370AD2DCE98F1F00C885740A950A2E6A90
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 853cb572f815d553e269789cec663cf3143b9552dae1c7e38236fec76f32f9d4
MD5 40cfae6f6f443c7c0be1da601576580e
SHA1 76363a0a0a2708a11a57e30884f02a12bcab5e9a
SHA512 b1a5748ade714a9cc791ea7c8b5e02fbd32cbcd5f0d8fc1eee25cb792796749751be55cf7a7a37372c5ac7f70949c4e88aa69deec7ce227ce1c6523352d1b050
TLSH
T11C316E708F342AFFDBAF45B657E24A9C3371885B37072E502364AEB48A8A377201011E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ed9ce785e0a5c726a996a4bb8fbb1f81b9af6cdfb9c1f28bfb79b68db64e63f6
MD5 c8e7a611197de85ba5071df7da846f2f
SHA1 43597519aa248ee8fc5d3ef74f2c3af5e91492ef
SHA512 fe1e3be94a7b5089a17f6ee74a27381a4300022df7bf7ea55da4c2cad3ad28d083113b5d7b0162757da11c64d1e930b9a6405bb3381049b9c66f9a046be8dc1b
TLSH
T15841BEF383F4956E8D0156F0AA14AE2FCF2D0511432C7D6AC9E0AE2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7405568964d06076e89da39c2fb1947504c83de7eeaff4442d7f890078e9f0f6
MD5 ccd6649f54a0f416f7df790b52aa1fb3
SHA1 20eb7bd80ddbdba9f20825719e2cbd84865c04aa
SHA512 aacebd29406e2ff0ff3dba05ca10d842cedc407bdebcedb1895bcd596c085cfd1d03d43327c485b5b71b9791d15a2845b7608373417c1747c6de1d57f07e5b2c
SSDEEP 192:sxRMRICf/fZsIHdZj2zoA8p4y/g6+WNIYo5OiYoGnIgV+J:sxRM1f/fZsIHTXb/5ItoQ
TLSH
T1E742A7156D29A93B4CC7E61DBB59BF53D2F91032A1D16E48AAFCC61C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2119a2133028714710499b96e9ca739af7b03d8eb369e99f5f03e66050823ddb
MD5 c38d7c7173e6975b00f91eb37d8e35f1
SHA1 56decc00806a4d1b1b049c41942d01e5b8187bcb
SHA512 1832bc90ca01f78613b055e907f82d633cf991fc78401c090ae92e5ea1a1b6ebf0020961f65671fa109418b600a3fff0e914838e2b8130fac2024f92bac5b159
SSDEEP 192:sxRjRICf/fZs0AdZj2zoA8p4y/g6+WNIYov4iYoGnIgDA+J:sxRj1f/fZs0ATXb/5Ito7
TLSH
T1BC42C7156D29A93B4CC7E21DBB55BF53E3F91033A1916E48AAFCCA1C04E76DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 659a9dc42b432dbd5b6467e80f1dffeca3e26501d1d31072ef35d1c69720a1c2
MD5 57d4383bbc9ad0c0fea0767cd779c5ff
SHA1 068683248982fb38089fdc4dd513d18e870387c4
SHA512 2a0b79cfe5b65e4f292cc5a23d6b2032a1e9f621de1a4204179137bee1b4d9c1fd32c9ad10e86870db242e36499c817e982dd37cb628c5b6bd9f92962577c72b
SSDEEP 192:sxRjRICf/fZs0HdZj2zoA8p4y/g6+WNIYo5OiYoGnIgDa+J:sxRj1f/fZs0HTXb/5ItoF
TLSH
T13642B7156D29A93B4CC7E61DBB55BF53E3F91032A1D16E48AAFCC61C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e67e522af5c519c992bd158b8c64d24d64a9341226315846046c7759347919ad
MD5 6eb16ddde4885620b6fd766fd96eb628
SHA1 a4e22cf4360d91cfcd000e91689b074e987fa53a
SHA512 db1b62e800523c8e2bf59a4d9a3136f1a2746c751ba74d8f419985eed3b3cf30d4492e67122c2c344c374e5c78f85ee87855499bb7b6818b746ee2a5c8215db6
SSDEEP 768:j26Huo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVwGBVuwKro90e0y:j26HuUE7MRWgs2f02u1jabGB4whL5
TLSH
T13ED2DB7B640DCABF4F804ADDEC197E9F6D6802CB9698CD8047FE841C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d9bf7267abdf0a90e865759cf1c66a1c93acf19e547219993d429da3dec282bb
MD5 918df8a4124f590362b85728e3de8deb
SHA1 b0ef6f39773950f6b9da1fc49ca0346e56acda41
SHA512 15ce3fdd5516f443aaddedd5097f9c4efcabd4f3f0c19455a276fd82202a209e7a2f9c21792c01c2c5e18a113cd40fde517c2db1ef6e4eb6c66f77bf7a2327ec
SSDEEP 96:KRENE8EzEnE9EXErE/WEzEoEWgEvE/K4EugERE/cEVEtEgEDEbEUHEuEDESEOEo/:CENE8EzEnE9EXErE+EzEoEHEvEFEugEg
TLSH
T1A8A10850B43B4381393DB60CD8B88D5E81D27896345DA5AB3B540661CF6FE538EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ce121a99813f8288cf41e03ff3ba38d64f2044fffe873b774835f4c24c215db0
MD5 1a86940ef05de73dea804d0f451337ed
SHA1 74ae0b1e78af471a6f00e8a8d15ec97787c840eb
SHA512 ed3fb16833b5c57b74fa08a79ef3d67e0f1b703b1834a69eecdc5458335a9bec7f63a7dbe2ef58ced39db00bea62876ee92fb25fbd14d9db5665598e13ba6275
SSDEEP 768:GLFQN3EwgJQkvXmOWZAGgONXyer1IRCzni9bfn6:GeN3Mr7SIqncfn6
TLSH
T19803AD31D895CE279CE9E3C6B6067383AFF41063C8C58B50EED99F5D05576AE230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d2f0c5eafc79a3f4899529659718ee6e663ae58b47802a6b35a0eef3d26e0902
MD5 7b31ed5781e1bfa14cb5e5b8d9f02511
SHA1 8cacffe8a8986ab0f8976e6fd770c3786ea15e0e
SHA512 eca551f2e41bab5a9f2e8537bba4ff00a077ee27d7bc644dcb49a26c74622136d71d77e9b87db49c82e9f6c0069b406f87d544b435c8e977d99f9368abf3a6ea
SSDEEP 768:hrv+4UNbdz3J8/TBOWZAPONXyer1IRCzniB1eVH1SK7:hbsbV36CSIqn2EH1l
TLSH
T1FA03BF32E4A89E338DE2A3C6B14777437FB85057C6840790EDEA2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f9720f4eaf47c385e289b4e43edb8611ea9993d6a610a3c7029d4f212db3f5f8
MD5 28e82daf75b9e19bf079b985e4135940
SHA1 32f7c70b8ad1856228e5ea6cc428ac501a4130c5
SHA512 ccde2f5ef7820a0a9eb6f0b830f602dbe809d89cabdc01375cd65a5917293b9d743223cdc10e8093712a598753addcd84d2bd9964f384e7d5edd64ae6c653145
SSDEEP 768:Sk3vQk/TBOWZAG2ONXyer1IRCzni9bfn6:Sk3vrASIqncfn6
TLSH
T179F2BF30E4A69D230CE5E3C6B2066787BFB82067D5C54B50EDE99F1D0597AAE230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 af3caeb78d2bf0be1c2a2a43bcf3e79fbb768d2bb87fe6ededae31471aa4bb2d
MD5 3d6fd1d82a217c7a92bc511fd2d54eb1
SHA1 b313836cbab10b22ebaf9deb15457845d3c2992a
SHA512 ee1a2bf5ce02e5a9a8a5033612bf96de220271c2df9612f020612a7ee995ed6d8b8f5f9840d8d19b03c856c9046b91e131d803f274b6127cc68e38d3d42f5810
SSDEEP 768:O9k3WQk/TBOWZAG2ONXyer1IRCzni9bfn6:O9k3WrASIqncfn6
TLSH
T16FF2BF30E4A69D230CE5F3C6B2066787BFB82067D5C54B50EDE99F1D0597AAE230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 15a7b185a06aa2c9327c6b8882046de879840507c036805bce49824054a489e7
MD5 fd75a09d6a4c760e22fe3a49c7a8b4b4
SHA1 4d5905e3763edabfd58b4bae66216673d73ac9de
SHA512 77d5e38c5c631f7980aa8be8e48d65bd2b25b2ddd5db0046ff075fbad5ef0c4f7420ca4392cf4e031de74aefe4760faa097d49aadbaa6c0fb9f5d3cbac93b232
SSDEEP 768:+rv+4UNbdb3YbCk/TBOWZAG2ONXyer1IRCzni9by3SQ:+bsbJ3YJASIqncxQ
TLSH
T1F503AE31E4699E234DE2A2D6B14777837FB8206785C10760EDEA6F8D058759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2e8981c83680d5f92d7ac238fa344ff1802930abaec3d89fbafa80dfd269ae8d
MD5 713253ff51d7fc3bc9cd91f2f18934f7
SHA1 861a08367407392709a0a9a1529ccaab5a004ba9
SHA512 5caca0a6e2d983e3d7b149799cdc2fc0b5da3d29f840ed238ab8539ab70525b9d919c6e59c077f34510ebc216e716b80cd55ce08fa728793f066db60024c11e5
SSDEEP 768:Jrv+4UNbdz322/TBOWZAGPONXyer1IRCzniwbeVH1SK7:JbsbV3/9SIqnnEH1l
TLSH
T17303BF31E0A9DE334DE2A396B14773937FB8206789800B90EDDA5F4D069759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63b42dbd-fde3-4415-beb3-b9f8ffaa5c1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63b42dbd-fde3-4415-beb3-b9f8ffaa5c1b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4148_439690112\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-195-0x0000028A03000000-0x0000028A033BB000-memory.dmp

Download