1df8b17469ac1e43fc5d71086a2f143372406d58aa52a2db8437fbdcdaf483a1

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/uires/image/un_logo.svg
Size 35KB
Sample260719-php32adw2z
SHA256 1df8b17469ac1e43fc5d71086a2f143372406d58aa52a2db8437fbdcdaf483a1
MD5 f1b31b9eaee50c13137e6c2886b2f1d3
SHA1 61dcfd45936e81fffbd69a7b7a21d4cedd91aa80
SHA512 ce11bc7e3e89314e9398fb05360f636354681c2ce8ba684d0d993eedd049450f7157d2bfa65277b1912b5949672895c37e521d9fffbbad8a76dda31ee944d2df
SSDEEP 768:egpMaQyYKgXxbjhUvFDTGRAvNSagCnIge64LVa1VlcsKM:eg/5Exbj0GRzaLZlncy
TLSH
T14EF2E172F9915BB4188523B8E2672A6CCA235EEF548125DCF24D5BC407A3C989E1F4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4968	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289372153094815"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{75811F2D-12D8-4439-9726-C70E102E5A55}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5920	msedge.exe
5920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5988	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 5988	3280	iexplore.exe	89
PID 5988 wrote to memory of 2584	5988	msedge.exe	90
PID 5988 wrote to memory of 3904	5988	msedge.exe	92
PID 5988 wrote to memory of 4968	5988	msedge.exe	91
PID 5988 wrote to memory of 3904	5988	msedge.exe	92
PID 5988 wrote to memory of 3904	5988	msedge.exe	92
PID 5988 wrote to memory of 4288	5988	msedge.exe	93
PID 5988 wrote to memory of 4288	5988	msedge.exe	93
PID 5988 wrote to memory of 2588	5988	msedge.exe	94
PID 5988 wrote to memory of 2588	5988	msedge.exe	94
PID 5988 wrote to memory of 2588	5988	msedge.exe	94
PID 5988 wrote to memory of 1188	5988	msedge.exe	95
PID 5988 wrote to memory of 1188	5988	msedge.exe	95
PID 5988 wrote to memory of 1188	5988	msedge.exe	95
PID 5988 wrote to memory of 4836	5988	msedge.exe	97
PID 5988 wrote to memory of 4836	5988	msedge.exe	97
PID 5988 wrote to memory of 4836	5988	msedge.exe	97
PID 5988 wrote to memory of 5712	5988	msedge.exe	98
PID 5988 wrote to memory of 5712	5988	msedge.exe	98
PID 5988 wrote to memory of 5712	5988	msedge.exe	98
PID 5988 wrote to memory of 3772	5988	msedge.exe	99
PID 5988 wrote to memory of 3772	5988	msedge.exe	99
PID 5988 wrote to memory of 2412	5988	msedge.exe	101
PID 5988 wrote to memory of 2412	5988	msedge.exe	101
PID 5988 wrote to memory of 4280	5988	msedge.exe	102
PID 5988 wrote to memory of 4280	5988	msedge.exe	102
PID 5988 wrote to memory of 2288	5988	msedge.exe	104
PID 5988 wrote to memory of 4528	5988	msedge.exe	105
PID 5988 wrote to memory of 4528	5988	msedge.exe	105
PID 5988 wrote to memory of 5372	5988	msedge.exe	106
PID 5988 wrote to memory of 5372	5988	msedge.exe	106
PID 5988 wrote to memory of 3888	5988	msedge.exe	110
PID 5988 wrote to memory of 4296	5988	msedge.exe	111
PID 5988 wrote to memory of 4444	5988	msedge.exe	112
PID 5988 wrote to memory of 5252	5988	msedge.exe	113
PID 5988 wrote to memory of 5252	5988	msedge.exe	113
PID 5988 wrote to memory of 5920	5988	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uires\image\un_logo.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/$PLUGINSDIR/uires/image/un_logo.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8c55bc188,0x7ff8c55bc194,0x7ff8c55bc1a0
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,1923693871222815424,14602509786947353167,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,5444767401297796928,6409092361544704132,262144 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,6933863711613251636,6078086786289384983,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,5189697764222305344,7221965213978752252,2097152 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,3881034882330298877,3936200386702262777,2097152 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,11244042929236833794,5775580918338035912,2097152 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,12959122122271012176,9407521225992561210,2097152 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,10057993013849687785,10208367940022269650,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11394539352027559654,3479978576066546949,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4179402992538477505,2332236526770605739,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16363966620019124827,10431065234513795456,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16363966620019124827,10431065234513795456,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,4339998948002266092,15140232853797524967,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,4639666361295920788,6808114013061779649,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,18343311729108906765,17797888390982920672,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,4405607001308710094,14398899664246205438,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10384921638053951118,2538425739211605615,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,15508528409820457704,13396123481556433139,524288 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,11730568698960128329,11668311613339656003,262144 --field-trial-handle=2272,i,4616093037903928217,8363206631059838000,262144 --variations-seed-version --mojo-platform-channel-handle=896 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3bc6f5c22e10305be021a6318b0eabf0a6abf49a3bdc5b39af41db7ab0278e3f
MD5 04168e374d81980fc5f3466ce4149565
SHA1 292f2330e00859ee9546278a7256f137039595ee
SHA512 87855cfb3a78e7d87b2345fa049ddcadfc780ea959a15238de760aadddea6c61d083e45f41ffc37deb36919420f10e888485a11d7239e8afc3ab6380c8ac066f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T132B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 598e8715a364fbb87f952641ed7dd3387fdbead57a1c9c725af5098d80983e7c
MD5 b9f7f8750f3ab726fdee85b2cdf06bf6
SHA1 9b391700ab654367d4e12b43b2f839af84a63ab7
SHA512 a0750bd3e4289a47ae63458b803eec3fdd458651581f0bdcbfe588f515d168b46e5dcbb73046fbca4811fa92e9e8a5112d85c51dc61965a18f8b5ef8c8e71a0e
TLSH
T196511E4F037679D1FB699CB318E1B559B2F3B15906131FA040A21FF0C9D6F95A2DA093
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5987c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5987c4.TMP
Size 3KB
SHA256 dfada0c0212bffeeb0657248e232370353bf2d7e1929c731c2318c8607fbe752
MD5 020a143e8499feccdf0da97cc12f8936
SHA1 a74cc7970e430a7ebcaff4cb16f9f093d3c9e06d
SHA512 7f12a1161fe0cc06b35b174559bdd33beb3f9881963c090b0df6da4eef6df5a4f8492860201b7e1a43dd8eeb72f56f23a1bc5ab2dff98301fe3ed8fa38cd5ed4
TLSH
T13C512E4F037279C1FB698CB318E1B559B2F3B11906131FA040A21FF0C9C6F85A2DA093
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7ba46be1e4bc9272895c0a8db4d8b88a16fb14494bae061f0437f88a9500fe57
MD5 66a9f07b946b746ea1b6bdc2ff566590
SHA1 69b921f4721048c18390be31953d2b0dec8ec0b3
SHA512 63cc52728f1ec0fc876a48cf0434351d8c2d6d9f2ce97013fd2af6afc6a8ce4fec16bfdb2e73929b23b7983c72dbfc9aec6fad99efc54df8498f0be12a729efe
TLSH
T10441AEF3C3E8866E890156F0AA18BE1BDE1D0915832C3D5AC9E4EF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ab45e606c3d1c7445670cd57960af73c5783609a09b2cfe6991be7e7e8e03fee
MD5 d68a64596beedf1094568da3b763b0d2
SHA1 6ec0f65f8b2b706ec0128dea079405192b9b2f28
SHA512 f62299287c9cb86d28bb4912f39e6a1d4bfc00ef1bd86af020c4106caf683e5ecf38dde67d628b0dde3dc24cb39b625565e30d3eb25ed92a5063e7fabe820d10
SSDEEP 192:sxR4VkRDyM/jK1Ml8wCd/fgsDdGuLZUzzoA8p4r/g6+WNIYD986SGG+3IgtJ:sxR4uh8d/fgsDdGulUii/5ISS43
TLSH
T11C52FA156628997B8CDBD20DFA517F93D6F91573A2901E44AAFCDA0C00E66ED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5e666ae1b830b852da7b78648a4c615915d917e1ba09097b25f2d9c1aa028786
MD5 7733c48992efbe65ca51caf55e919f89
SHA1 9c05c11f9a4b60d28dc712bedc62451b4456181c
SHA512 251bed87b51c702f207f4d625b145e1662d1e34d4261cbb3829fdb74d879431feb140d692199b64d892dc351d47b4d05abac057184d414663b988b7e12196145
SSDEEP 192:sxR4akRDyM/jK1Ml8UQnCd/fgsPdG+LZUzzoA8per/g6+WNIYD9d6SGG+3IgDHJ:sxR4ZhqCd/fgsPdG+lUiI/5I5S4t
TLSH
T16362E916A62859779CDBD20DFA517F93D6F95473A2901E44AAFCCB0C00E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2ae6302901f988d784ae275854d9551312f8254081a3509e6480c6618e0e0f4e
MD5 3262c17918d6de84e1f7c01d7d8c3d01
SHA1 4160e9e3fbb08e58b5a4e23308a195d818b681b4
SHA512 4231c62035af5dd153f4bcc74e241fc6bd9b5995a3ee2288e311b7a02fc0e9a5085b5b1fc7e2c54fc38c5b539778180bc67d000be65d04bdb5ff6d8a8bc0cd3b
SSDEEP 192:sxR4akRDyM/jK1Ml8wCd/fgsPdGuLZUzzoA8p4r/g6+WNIYD986SGG+3IgD1J:sxR4Zh8d/fgsPdGulUii/5ISS4D
TLSH
T1D752EA16AA24597B8CDBD20DFA517F93D6F91473A2901E44AAFC9B0C00E66ED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 34f1b3afecd8496076564d021496bdf61a55ac6bd538526071caf8963157019d
MD5 40ed6c0bad4c3946075cb9e780172da6
SHA1 76fa435f397a72d3f46c5f9df019e883cf777c06
SHA512 188f33eda71ea4252e9afebacfcfb172e3738dac4cf3fe54f4b94c394126c767bd13adc46201939d65186ed8d8d59f34959e909f7cb4b8156c0515f490178d9a
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPXHc1slro/lQhh:aW5WFdE710Wg/XfCfu1jaMXHyse/lQX
TLSH
T179E2FC3B280CCB7F4F444A9CAD297D9BADA801CB969CCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a89deed13e0887601d3ee385517b7e40d409d5234539b1641f1958a5b3643fa3
MD5 50caff6278b39a8ff83f5196eed3223a
SHA1 70976ed0189e7249769dc0a1850917a7bb82c645
SHA512 310739e11cc505f653c82c0a6f5b5f9f6b45c19693b25a95568f7102fc11bac38a7016f32cc44d8785d85e605a99b7b364d2b70a7f1e93d735fb444072c2f571
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHc9oMmqesWa33gUsK45gesc8M32c8X8A8a:C3gFB31lERe1JDggH2vHG5FaHc9oMmqP
TLSH
T1A6B12741717A029538BFAA0980BE8C1F81C1B4667315E52B3FA902E64F67E339DFC5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12ab4bff-3d37-42fd-8198-19f7effcba87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\12ab4bff-3d37-42fd-8198-19f7effcba87.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5e08573b0ffec704fcd127cb1ff6ff33a2f5a99d8e5aa69f7e7b997d53e4c1d8
MD5 e3c0a58300b04433cec002a8bf8c08aa
SHA1 e61089cb3cd5fe28607a8d98c26cf104c25072a1
SHA512 6c4b7a14e93942855b2cb85b1ed90b54c9e2d54058e27c2a7e86db32202d21a13c8456de2c123fdb217bbe7d390a0447bea0e34c20e611201928494619f2cf97
SSDEEP 768:4F1j+9+3fwgvMqmstrEnjN3Gac1F4b9Mt:19+32QtQnjMazb+t
TLSH
T171038E36A965CE779CE797C6B7467A47EED002A385D94DD4DAC9AE0C00C35EC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f8f914b10338fa7723e46e798526a92b3b7910790b040775bebb2ed8d19fa1ab
MD5 b88b6d10f6027a9ee72cc73662cf0d6c
SHA1 a4e44b3c99758804ec67adfe7b0970eb76a2c5be
SHA512 3b26059cc10eb5feddc545000a12524753dd6384736cbb84f1eb6854b88f66be58639ca6f64c866a3de4efab8736339038da6ae4d88b10c932f57a5ddb93c10f
SSDEEP 384:nVtNn/s3n9S238N4C0LIW+FHq0WZlf8hyEGojF4QF2y2rEoajo4cdR8eHhVODjYn:Vj+9x3vMqti03rEnjN3Gac1F4b9Mt
TLSH
T12AF2BF3469658EB38CE7D39676473B93BEE0476385D50E98DAC9AB0C05C36FC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f0a61fc10fdf431c0daf4ca4efb37ab14dade00075a9b1d0bf320b60eb64de1c
MD5 3c45205d3e79d905d63d6429376240e9
SHA1 2ca5da87593db20fe2c9a488da157da407f60a84
SHA512 9a83860ce5a2a517b8990cf4146f99ef8ac68f23de586c1ca786de6d644fe0b08b35adb0eef772b1b1b2beff5686892433d4c2d5fb1ce327296fd3e18fb69281
SSDEEP 768:rrv+4UNbdS3D3mi00rEnjN3Gac1ZceVH1SCz:rbsbg3DE0QnjMa7EH1V
TLSH
T1B203CF3669B88A738CE7D38571877A037EF4525386D40BE4CACD2B0D469B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ebe29fc7565897176dcf327ef0876cdef78bafe07b2317c9acd638346b8e6306
MD5 e93eace937f0ca106711fa70ff0927b0
SHA1 3c6d59a67c17b8f67c6d42f5093b4b56868df53a
SHA512 d373d3b490a80d59c52c1d69d578278f3c1af0ab00480f54554e2f1a8edd6e452246f7a9f59ed94a05d10fe4773d0a9e61d2196fc69a8142841fa7e0e6cbc62b
SSDEEP 768:3rv+4UNbdT3owqti03rEnjN3Gac1F4b9Mu:3bsbd3Ty3QnjMazb+u
TLSH
T17C13CF316978CE738CEBD356B1877A437EE4166385D50BA8DAC9AB0C05875EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ff5b059-f52a-4f7b-809d-497ef84e3c41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1ff5b059-f52a-4f7b-809d-497ef84e3c41.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5988_1353178369\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download