1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v13M-m7-eL.svg
Size 35KB
Sample260809-g2ms1sap4w
SHA256 1f9347f69fb7a2eef75c0468c0016bca4552541e955b3fdbd0c1dc1c8fbfe388
MD5 bfd57f9c04b8bfc4e5434bae690e2203
SHA1 e7b3435c094295274f0af2f8397f5bb45ea184c1
SHA512 6758b4a12d192d174ef164e40e6e9404b61b978a9fb28913f7bf0882d22b005217c3f048344f661fc2e264b7060e3cbe73503e4b546688f5342e8ae0eff3613b
SSDEEP 384:chMBVd+SOAKzMf2qACRnJPB/nafePgDOx48FAIddEIRisu:c2VdxlZdIV
TLSH
T19EF2306537F43C9B8BCC03479D42FC6C46AF98B78098678D97D790E8A548368F7AC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307298984990022"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{067A04E7-CAB6-4907-8C80-39697DED2C24}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2736	2932	iexplore.exe	90
PID 2736 wrote to memory of 5928	2736	msedge.exe	91
PID 2736 wrote to memory of 4800	2736	msedge.exe	93
PID 2736 wrote to memory of 1752	2736	msedge.exe	95
PID 2736 wrote to memory of 1752	2736	msedge.exe	95
PID 2736 wrote to memory of 6116	2736	msedge.exe	94
PID 2736 wrote to memory of 6116	2736	msedge.exe	94
PID 2736 wrote to memory of 6116	2736	msedge.exe	94
PID 2736 wrote to memory of 2412	2736	msedge.exe	96
PID 2736 wrote to memory of 2412	2736	msedge.exe	96
PID 2736 wrote to memory of 2412	2736	msedge.exe	96
PID 2736 wrote to memory of 3280	2736	msedge.exe	97
PID 2736 wrote to memory of 3280	2736	msedge.exe	97
PID 2736 wrote to memory of 3280	2736	msedge.exe	97
PID 2736 wrote to memory of 2384	2736	msedge.exe	98
PID 2736 wrote to memory of 2384	2736	msedge.exe	98
PID 2736 wrote to memory of 2384	2736	msedge.exe	98
PID 2736 wrote to memory of 772	2736	msedge.exe	99
PID 2736 wrote to memory of 772	2736	msedge.exe	99
PID 2736 wrote to memory of 772	2736	msedge.exe	99
PID 2736 wrote to memory of 1504	2736	msedge.exe	101
PID 2736 wrote to memory of 5260	2736	msedge.exe	102
PID 2736 wrote to memory of 1504	2736	msedge.exe	101
PID 2736 wrote to memory of 5260	2736	msedge.exe	102
PID 2736 wrote to memory of 5884	2736	msedge.exe	104
PID 2736 wrote to memory of 3376	2736	msedge.exe	105
PID 2736 wrote to memory of 3376	2736	msedge.exe	105
PID 2736 wrote to memory of 1284	2736	msedge.exe	108
PID 2736 wrote to memory of 1284	2736	msedge.exe	108
PID 2736 wrote to memory of 5140	2736	msedge.exe	109
PID 2736 wrote to memory of 5140	2736	msedge.exe	109
PID 2736 wrote to memory of 2372	2736	msedge.exe	111
PID 2736 wrote to memory of 3984	2736	msedge.exe	112
PID 2736 wrote to memory of 1172	2736	msedge.exe	113
PID 2736 wrote to memory of 5300	2736	msedge.exe	114
PID 2736 wrote to memory of 5300	2736	msedge.exe	114
PID 2736 wrote to memory of 1664	2736	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v13M-m7-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v13M-m7-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff860c4c188,0x7ff860c4c194,0x7ff860c4c1a0
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,14019174270983738457,1339163824218283204,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,827709227979767207,14750220672098199189,262144 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,5673597266739992352,4568177297172758427,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13757539565178805445,14813536024051475701,2097152 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,5366062979228151060,16275561447987427000,2097152 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,4818256039462621354,2389913781720926394,2097152 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,8609992513275158297,3546030308456241805,2097152 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,1225296996663592815,11124265662996573323,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,14167037309919913030,3847202045478544629,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,14634071804777748171,12724153550713274372,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,14634071804777748171,12724153550713274372,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3736666018243619719,4769793152159448404,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,1293036074026765176,17286577770558813996,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,12968362641497988645,15978865740642369166,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,14361601150780899990,2884005370638177708,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,12691736884229796387,9033506883642115833,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,6053855690904935074,3214698743737365471,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,11011300926256451642,4647761360442173443,524288 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,10728771425123869560,9297933900887750595,262144 --field-trial-handle=2312,i,746895507055753819,11503678405846236777,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1894c8712430c5e3fa029cb6c080b5e590f82ab603a5c8811c66b7a124c065b7
MD5 94432da56760945aabc59a48f27df3c3
SHA1 3083cc3ebda4bc68becffb15a720ac065be9c40b
SHA512 2c7b8d3649a23c08041b5470c8c0e0f5ca31d68bc7d4ac0718fb30e6cff6c8323a0d3641b0537a0f072740ab03c985fe3f5e10b45d7cc803979ba50c5047db1b
TLSH
T1C4612BED733EAFC3FF604CB29CD0A49A32E48645062BAE83A1501DF0480EF2561DB127
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aec4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59aec4.TMP
Size 3KB
SHA256 43aa499c99e6d9a006fe07fb1cc52f69521105344096af3f8aa9b183b19318fb
MD5 8755102be5cd4d5d738a65742ad4aa3a
SHA1 4b10ca1d7990c6be7e82ea51fbb588d53b8e9a7f
SHA512 d035ba5981eef0f227d53e44dae002cdae5525389bf72ffb1fbc5911013e8eeb55a9547738540e5e8a44027b5b8b359347d9b346b724446734f63024e9833c85
TLSH
T133612CED373EAFC3FF604CB29C90A49A31E48645062BAE83A0501DF0480EF2461DB127
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a0d61080b63e0a18008c36eca182dd7fc1da7848a06945e76648c42d407af887
MD5 d52564afa4218eb124e57d5dd7748503
SHA1 e5df8ff95faa1d8955210efb38a0fbd4c5a96dcf
SHA512 17e2b3592b9e9904d6fea7c4ad7eba019bc9d8e739cb2af115577029bedb788dec3d0a9c7217bd6d728b4543f1a187f5ab42f6e537f08f53c127324c7d8f5ae7
TLSH
T14141ADF783F4856E8A1196F0AB146E1FCE1C0915432C7D5AC9E4AE2793E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f119cef1503d41137366dd00032413fd7730cee84eb439cd3ad6ff79e1d0602a
MD5 f8146c7d3f6ee9798e2853386e625689
SHA1 7023662e75c8c561901e9428464cb6b9f8407b5a
SHA512 5a66d04743427356b731101e834b77ebc711513bec8546c18919efd50aca3b3a79d83e4c7f9fd7a395b014b4d780fa3c125a1161c7c20fb4ba316ec68627756b
SSDEEP 192:sxRvR+Cq/fgsZg6ZrPrzoA8p4I/g6+WNIYn8NKhqGqIgDYxJ:sxRvfq/fgs+srPKp/5IT+oS
TLSH
T1D542C8556928A93B5CCBD20DBB55BF53D6F95032A0D05E58AAFC9A1C04EB6DE220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a54eae0ca10c376647f2df6790a6223beaf144fd3af46881a2bec4cece0cecf0
MD5 eae58b190f24d8e4cce20ba46c8799cd
SHA1 d133c78856c584fa8ddadf9333afa3441a6c81ba
SHA512 26b0a5c7e98dfe840f251b8433ed0451a350102239a85b2fee9e9bca700566a4323d516c1aca621b8e5c53f2a81300c641eda6d59bd39f0e470c1eec32358e2e
SSDEEP 192:sxRkR+Cq/fgsFg6ZrPrzoA8p4I/g6+WNIYn8UwhqGqIgVY5J:sxRkfq/fgsisrPKp/5ITboG
TLSH
T1C732B7156D28A93B5CCBD20DBB55BF53D6F95032A1D05E58BAFC9A1C04EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0beee5e0582864366e2b72391a909f55914e93a9adba53936c1ba94b9ac7ea16
MD5 ff525cf9e54f32a834bfadd05e284460
SHA1 a7458ce259fd6b7141194a0130bfd90c1b94ee70
SHA512 31573fd2114b4d2f83975288fecd8987f50e663b4512e0e31e7da843cff9abdb375350afad6d30b392a67f66514dc6707b1a196ffe7d57d2e65dbad82f9181d9
SSDEEP 192:sxRvR+Cq/fgs0g6ZrPrzoA8p4I/g6+WNIYn8UwhqGqIgDCY5J:sxRvfq/fgsDsrPKp/5ITbot
TLSH
T19E32C7156D28A93B5CCBD20DFB55BF53D6F95032A1D05E58A6FC9A1C04EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9d842c78731bf39f1d3b98af191e04019e22b80d7587bbc5e7b1fca8e903d419
MD5 2e7a31eb8be7ca2bf2afb210b2619deb
SHA1 13dbb4fd48409a576facdf4924555bafa3ab780c
SHA512 d02a48ad7c0d5e8d214beea34ab61505674e4d61662c7eedf8f8bdec5f6527581ea04b774c7ed75cfaff5baab6825b7a3f2707e2dc707d3680bd66d37201dc98
SSDEEP 768:wb8dpg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2emu46SrohmT5M:wb8dpsE7r6Wgouf6Mu1jaBemV6Jcu
TLSH
T1CFD2DA7B740DCA7E4F800ADDEC19BE9F6DA802CB5AD8C94447FA941C02C6BEB51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b147ae50-b589-4f72-a81e-f73c95bed2d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b147ae50-b589-4f72-a81e-f73c95bed2d2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 62870c78f9fc953a81b1b89cd0a530631930f34ba96bff664bf628575ae485d5
MD5 4441ae50c3ba57b5e23fa31a7b4878d9
SHA1 d1919be6b138219062918328548011445b911cbb
SHA512 2a9f361b6a6e7b75b53f6ba6ff1e11bfbb7575c293dd252cb87c2dbc389079e38141350edff8046bdf2cef63fa2e973ab2fc581a1d0ca3bd9ae7cf1b1eef62d7
SSDEEP 768:Vrv+4UNbds3XgDZIO0UiAWNzc4ReyIs23eVH1S5D:VbsbS3GWtc44bs0EH1Y
TLSH
T1E603BE32A838CE33ACFA6746B147B6933EF8216781841E94C4D95F4C0A472DE231F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3b2db39084d9c10fda2f63bd22ed779c38f54a945ee16d96c5687fbe12c6d065
MD5 458e1b563595dfd2b2d115f1a9d5b0e9
SHA1 a7dec88fdaccd2b1906a612171219c1f21901b05
SHA512 559d042d62049a7c18198fa5d913d0ca9dbfb967fe4d8bcb6c39708f55589cef28e4dc17760c96f27bde0c5115740ee96a779a264b3769c5c0bf30e33cfaa5f9
SSDEEP 768:YFQn3HwgPXZQ5O0UiACNzc4ReyIsP32ewBKZOau:7n3dCtc44bs/2evZru
TLSH
T157038D76E864CE67ACF66786F6067643ADF41173C1D8A9E4DADD6E0C04832DE170BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a73fd017f926cb63ebb047ab5ad8b794e31f59d07cf9c59825480113c7f0b1c0
MD5 80992c564ed13619c6d8aa2fa2cf707a
SHA1 266419a5e9a2a9a35d0ed676a40c865452b63f54
SHA512 05586466183ee22dd0d6a9d59525aa79c823a6901c5ab35ac5bf2b82f6eba1f4dd5b100c119ea1fda1bc29e897d066d2dc1e5a2ebf3e4d7d6bf2e2b546ea8803
SSDEEP 768:r33HWDZIO0UiAiNzc4ReyIsP32ewBKZOau:r330itc44bs/2evZru
TLSH
T109F2AE71AC399D63ACEAA246F50676937DF41173C0D86EA8D6DDAF1C084329D271F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 db845a92be6930d019a1200fcdc67781f5cc2b93d9727f13142a2dcea32057d9
MD5 bb4f62ab7a5eb9d5b3ea6e52109f2406
SHA1 19b23ad97238059397e4a99e278c91680e5fbf23
SHA512 e6a7914b5b0596999194d4e68ce5ecece88a82f3f07a58eef48e9c8261e67b60b8be320a0e82b299fd00e70ccf3811c2728d64498f10b35a863b689a83db9033
SSDEEP 768:n33iWDZIO0UiAiNzc4ReyIsP32ewBKZOau:n33nitc44bs/2evZru
TLSH
T11AF2AE71AC399D63ACEAA245F50672937DF41173C1D86EA8D5DDAF1C084329D171B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bfe576fb90a01ea810f4953c691193111f7341421ce5d1a90e1d519fe52be123
MD5 2534fa300e26710f015e0f3429c63292
SHA1 d0dfd0e1cf25a8f3c3e679ab26914917f5462780
SHA512 523e560f0934fe093f9d6f557a2e47be4cbd6a83f13fbe562df454b434cb3248b3e33ffadd63508b92d7097eb4ab493fcd0e7a7939ad08042896dbaa9de88140
SSDEEP 768:6rv+4UNbds38BDZIO0UgNzc4ReyIsXkeVH1S5D:6bsbS3xtc44bsUEH1Y
TLSH
T1F403CE32A8789A77ACF6A786B54776533EF8512782D81ED0C4DE2F0C4A4B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 57a7541da4c5f25551cd0b57f9cf238b629f519584b4fdaa8d96195fa24c34ec
MD5 e8ae1d36787835bee30ef82071c8fcd6
SHA1 73eb7175fbc08ff1e2814695f5f4f313782c764b
SHA512 dce47ce6396584f2cd01491d6d06bdf6b8a3655b7ec906e880b58e3e07da5c53171138677e991f92a86b33f23e5239c4908f6528f94a90261d7dfa5f268265b0
SSDEEP 768:xrv+4UNbdg3jWDZIO0UiAPNzc4ReyIsP32ewBKZOaW:xbsbS34Ptc44bs/2evZrW
TLSH
T16B13BE31A838DD73ACFA6245F50775937EF821A780C51AA8D9DA6F0C09471DD271F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2736_1861814343\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download