385d2d6ed3a18e7256ebad0a527a68c46a39f20b534cdd89528a3fb084525a04

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m5-eL.svg
Size 3KB
Sample260813-wfrbmscd39
SHA256 385d2d6ed3a18e7256ebad0a527a68c46a39f20b534cdd89528a3fb084525a04
MD5 6543ebf56ad638c15bd11060b03b1eeb
SHA1 1deceeb76ff2eff0c2c0e8d5b6ba97d08e6c9101
SHA512 8979dc038d83456b9f3a34b8a476c0823e3800b4c565f2522c420a3d8e2b81998746773fd3e7429db629a460ed20176871e96eaf4d5c0031540ae10b9a696c11
TLSH
T19A71278876F83EEBC7C802970D41D8B84B2F946BD822978DD3CB94D879282AC735D570
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1608	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311171401680904"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{1001246B-68EF-4ECC-AE26-3D158A99AD93}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5028	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 5028	4416	iexplore.exe	89
PID 5028 wrote to memory of 296	5028	msedge.exe	90
PID 5028 wrote to memory of 4912	5028	msedge.exe	91
PID 5028 wrote to memory of 1608	5028	msedge.exe	93
PID 5028 wrote to memory of 4912	5028	msedge.exe	91
PID 5028 wrote to memory of 4912	5028	msedge.exe	91
PID 5028 wrote to memory of 3016	5028	msedge.exe	94
PID 5028 wrote to memory of 3016	5028	msedge.exe	94
PID 5028 wrote to memory of 2708	5028	msedge.exe	95
PID 5028 wrote to memory of 2708	5028	msedge.exe	95
PID 5028 wrote to memory of 2708	5028	msedge.exe	95
PID 5028 wrote to memory of 5684	5028	msedge.exe	96
PID 5028 wrote to memory of 5684	5028	msedge.exe	96
PID 5028 wrote to memory of 5684	5028	msedge.exe	96
PID 5028 wrote to memory of 4740	5028	msedge.exe	97
PID 5028 wrote to memory of 8	5028	msedge.exe	98
PID 5028 wrote to memory of 4740	5028	msedge.exe	97
PID 5028 wrote to memory of 4740	5028	msedge.exe	97
PID 5028 wrote to memory of 8	5028	msedge.exe	98
PID 5028 wrote to memory of 8	5028	msedge.exe	98
PID 5028 wrote to memory of 480	5028	msedge.exe	99
PID 5028 wrote to memory of 480	5028	msedge.exe	99
PID 5028 wrote to memory of 3932	5028	msedge.exe	101
PID 5028 wrote to memory of 2872	5028	msedge.exe	102
PID 5028 wrote to memory of 3932	5028	msedge.exe	101
PID 5028 wrote to memory of 2872	5028	msedge.exe	102
PID 5028 wrote to memory of 3972	5028	msedge.exe	104
PID 5028 wrote to memory of 3224	5028	msedge.exe	107
PID 5028 wrote to memory of 3224	5028	msedge.exe	107
PID 5028 wrote to memory of 5480	5028	msedge.exe	108
PID 5028 wrote to memory of 5480	5028	msedge.exe	108
PID 5028 wrote to memory of 4600	5028	msedge.exe	110
PID 5028 wrote to memory of 5780	5028	msedge.exe	111
PID 5028 wrote to memory of 2608	5028	msedge.exe	112
PID 5028 wrote to memory of 2440	5028	msedge.exe	113
PID 5028 wrote to memory of 2440	5028	msedge.exe	113
PID 5028 wrote to memory of 3836	5028	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m5-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbab9cc188,0x7ffbab9cc194,0x7ffbab9cc1a0
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,2750227612470774219,3127075135215025200,262144 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,17463238278030334408,6845525566574087489,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,13574622149091848988,3255280598614202478,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:13
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,1862535312237989237,4104042988031840027,2097152 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,11280286566712409116,16476842252306651520,2097152 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,17618983137443281806,5095754024300762020,2097152 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:9
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,18363843885560726462,12090461558309832631,2097152 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,10451815664998842206,13816034683731015573,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,3582525339252249151,13452133877977901667,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,11957955627231764967,4847339862081409067,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,9731550624421259539,2231564738624522813,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,9731550624421259539,2231564738624522813,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,6393214933154502005,12757975139850115998,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15399418997108943740,14292210168658431460,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,9264606149371881259,16228211531132473743,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,5632271435789394871,7712003523422533748,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15439177703656632761,9526015160398477525,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,9742722655521924268,15734695322083583373,524288 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,4064812798599788688,18221852628180933268,262144 --field-trial-handle=2308,i,15443919089941364844,15288988754464748421,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

561ba9ea-b8f2-4fb1-8105-5eda519fa800.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\561ba9ea-b8f2-4fb1-8105-5eda519fa800.tmp
Size 14KB
SHA256 6feac6d578c3aff8478e0d8b2b1b942ced6a1bf45acdce95ca74c02f55dc197d
MD5 48eb47c634e446b517afaab874189bad
SHA1 c1f3fbd60d5a13a312c3b4df09e64b604cbfae89
SHA512 887e168f0f601decd877335a64f116336a198c3caed4f820b7245f7976ac9072bdf0b52629b983705bc76d0cafb2aaaae3515a34913ca841005742f62d52092a
SSDEEP 192:sxRnRKyM/jK1Ml8wC8/fRsjQjZFzEzoA8p4B/g6+WNIYE/hiK1G0IgDSsJ:sxRng88/fRsjQNFzlY/5IIsX
TLSH
T10962E915AA24997B8CDBD20DFA557F93D7F91473A1901E44AEFC8A1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6ffc214d0b7df73103ef2e40dc23891fd0b325aeab903404470f5ff32b8dc0e0
MD5 8ce21b0f6295087bf44c91e58c8c5c6f
SHA1 84b1c91d538921aee82f23e90ab61c71d90336da
SHA512 9d19e5d5996cd8fb7d0468ca36157a811c89780501b6e32d24ef51fe33214c7212736aebe3aef9fa278aed414d01b5d7b6b23cbeb8baff6f14df50b24b564812
TLSH
T1C35187566FB8D6E1D338E27163F1574433F9A8A94A079E122052ED32198EF87B0E0253
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599409.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599409.TMP
Size 2KB
SHA256 8ca1b1bf1e65caa1317e02568219a1e739ef8a8c47e40c7fe3a6aa64abdfb456
MD5 9d1d80d201cc6acc53c36313ed7d4551
SHA1 a201efbbe55d012d2cf36f3a4c9e981083af2059
SHA512 e407d14d08b5a06278755d39e2e6b0760fe952242e00df47da51dbdbd6c92e52249e014f6cf09ee70e3b4b9e81397cc2bc46d1eeaa7889ed846a5b66d92c53f3
TLSH
T13B5198566FB8D6E1D338E67163F1574833F9A8A94A079E122052AD32198EF87B4E0253
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70e8a28c-4163-4d87-bf1f-85c68f4f548e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\70e8a28c-4163-4d87-bf1f-85c68f4f548e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0d852d8d96e7fcfd29b935e10a985a3d3bc3c2ca1768951c3aba1eee3f5d7863
MD5 5a91dbcde247f76fd87e724a9e2e4542
SHA1 99caa5a16b5f790dab16586f833f2c7b4a3b9420
SHA512 71f05577131ac749f7734412d72dd529512e72e1f1c6c906d2511be461fa855a8136bfd8de715f38d8a1c112546ec742828927072a7d7500ce302053a2425c7a
TLSH
T1B441AFF383F4857D8A0196F0AA146E2FDE1D0515432C7C5A89E09F2B93F3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e22d4a610f217360b69a653ca42c78595030f4670edddffa05655944fb6843c3
MD5 fb443c49d17030e9fe0515c7ffafedb3
SHA1 77f4fe4f0e55badf0767114d2da7a2976fdcd5de
SHA512 df98e1e13b0885a1c48e02be776cdb6857ac352c466c49e14300a1d94f18a7777eb3778a034f71f18f6f93a8551a9a72bdf154303d9528a13281f87142c10783
SSDEEP 192:sxRnRKyM/jK1Ml8UQA6C8/fRsjyjZFzEzoA8peB/g6+WNIYEzpiK1G0IgDosJ:sxRngqA98/fRsjyNFzlu/5Icsp
TLSH
T1EF62E915AA2499778CDBE20DFA517F93D3F95473A1941E44AEFCCA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 56e933d99d814f3234e23d50669cffcd252184894579f61dc82fd90ee09e6834
MD5 42b5e57b7fd6b7807e0015883ec4f328
SHA1 73d94d072ced0a4ee58ffd2911afbe8c4d775149
SHA512 747a4cbab0625f529ea5644ddb1a1b056803dfa0a974c624288745d919d97d9d01408b8c839ab7a2db20d2b71f065a2767af83d7f42459b48316d6d26ce88ec5
SSDEEP 768:0hii1W7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMaeOV8Vro86A:0hii12E7jaWgH7f3Qu1javaeI8u2
TLSH
T16FE2EC3B680CCB7F4F804ADCEC29BD9AADE801CB56D88D9447EA484C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1465f4cc5d20eab2362d6aec5c3c2161ed640320cd23b7cf04d403207da5cee6
MD5 e9cc83ca5c6388ec5848516fa3fe4e68
SHA1 253fc6e35ba2ea31d561407bbf2336f637545637
SHA512 63a6b260672e84e502f0378f18232080af0d468a99e8ccaf82f4341ad396bd5d8a33eb30003be1b8952e8b33bf826400a90b921c2f880cd4c6b52969fab67193
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XH7kh1DZpVW9yogdVK4kgzVcbDa9puHYp8X:CeTieYgQxAl+eODgc1W+9M+XH7kh1DZ2
TLSH
T16291F441717752843C7DAA1D82B88C3A92C17872301C696B7BA865E64F66E039CFF8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5bc748f-210b-4452-bb36-f52d826366cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5bc748f-210b-4452-bb36-f52d826366cb.tmp
Size 14KB
SHA256 fc3241ff76558fbf602d8b3695fd6eb8181f78c38d28cd749d465f7d469a6ba2
MD5 3b0ea18016317d6ac96c583718af2aa5
SHA1 2f93a6ed715a2fc555fd2478d1a435d9f8308715
SHA512 c3ce64354cc4e8de5a562077ad0306fe6954a1d8cecfb2da1f6672736a1414862a70e0a655d04b3990f990ffe3db909be9ec21ee07ccefae40b84f88bdafb92b
SSDEEP 192:sxRURKyM/jK1Ml8wC8/fRsyQjZFzEzoA8p4B/g6+WNIYE/hiK1G0IgVsJ:sxRUg88/fRsyQNFzlY/5IIs6
TLSH
T16D62E915AA24997B8CDBD20DFA557F93D7F91473A1901E44AEFCCA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2bd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2bd4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 236aee04a974fed3ac86a7bb18127150aebf3ad5d6f7a8cbc6be96bc665f869b
MD5 a9de697a8afefd47f22b91178e5969e1
SHA1 0898026f7b5db1485ca54dd6c113c67d5bc0f17a
SHA512 a8ba4f2871568a3fe30a708dbb6ac2c06b36e157771caff2ab5238a8befe7c233df48101c9f154217cd54a4352e6ce9e8b679d9e9d2ae52d8031ff712a64965f
SSDEEP 768:b03/qGatD0NK48dHeByERRFzjK3Yw3Pi9PWym:b03yGY0k48dHSyw/SP3ym
TLSH
T1D8F2AEB068A4ADB34CFBD28976537757BEF40163E4C41A18E6DDDA0F058619D1B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5dcfa77992968c34b2969fb1e556891cf4287d906725913e14e6f45f2beb01bb
MD5 5e823fc3a47b53089903fe9443a25fd5
SHA1 77b5b8122952a625412439030cfe6e6e8679f486
SHA512 447b5965f6faf326afb80a0e09f720201c240d01b2b46b3dcd552bd3b820028130fd3a7595f56c2c06e765f4e313b2bc5e8f6a48e63aa7303cb1ca3307b81373
SSDEEP 768:lrv+4UNbdD3/qGKtD0nK48dHeByERRFzjK3Yw3y3j:lbsb53yGo0K48dHSyw/SC
TLSH
T13403BF706868AE734CFBD289B6477797BFF000A384C40A64D9C9AF4E058A1DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6fc6e767bb10ca970051e03342663d7039cb7173043fbe82448462def9e2fadf
MD5 6bac2a735d316741e3acf747966ab666
SHA1 6781d4c4c52b3f1dcef9762e85b8e74fdfeeeff4
SHA512 3356adb644a252905e32cc6c848312b28d30fcb187676126cb214c0de38bf8e44082f91d49aa82866dfedced200a39c6747810d4b0c7e2fe458671699d491a2d
SSDEEP 768:G03UqGatD0NK48dHeByERRFzjK3Yw3Pi9PWym:G039GY0k48dHSyw/SP3ym
TLSH
T10EF2AEB068A4ADB34CEBE28976537757BEF40163E4C41A18E6DDDA0F058619D1B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 454f62c3ecd401bafd3f1036d3286167e3d2b1a0e3de5d02f63ff7f027450ee3
MD5 772a851a2450368368d14cc6504cf516
SHA1 10077fa69513bb6ba26fad201e07b1083851ab23
SHA512 fa30a24bab646854adbea6db4516d0b0686610375a934f62bba848db05a71818cd779a4f33b4c84c3c16bc60be3b6afc5cd96bfaff78800bbe84673268d971bb
SSDEEP 768:jrv+4UNbdf3lqGnzD0KK48dHeByERRFzjK3Jw3eVH1SCj:jbsbJ3AGH0D48dHSyw/FEH1Z
TLSH
T16D03BE7068A8AD730CEB92897583B79BBFF4116385C40B64C9D9AF4E46860CD170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5ec97640a942ce83a125a9fd4837e07150bea444940cec7ceb97323b6f3a4be5
MD5 1080e74aacb546cafca10d15a459db24
SHA1 5536406ea0f76720a906d19a92a6ee1d514220bd
SHA512 005f35dc6286376d29814305513cb9c141b2d0935684a707e0e2ea26f494381e2f788c81dad8b66232e03da58055ce7c64cee63bfbc4883fa0ec699409a0c895
SSDEEP 768:Qrv+4UNbdf3/qGeRD9K48dHeByERRFzjK3YReVH1SCj:QbsbJ3yGkU48dHSyw/3EH1Z
TLSH
T13603CE71A8A85E774CE792897643B657BFF4412386D81BA4C5CD6F4E828B0DC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8bd78923e2d42b9bc121554ca266c95cc9d5999b3fd2e545d3546bb0a06d472f
MD5 b9b921c0c82d30a3e064b25ad8f1cca3
SHA1 8f3840e4363e81b77076b17ba18370773ba986ff
SHA512 3c603fdd9af6107b9c64fb977040af356ce130732bf4aaf1ecb79bd76f645d8cd18bbf5b679ae160600dc443205a1228929c971779e43b10c9964448672dcb49
SSDEEP 768:dFQX3PwgkqGaJ2BK48dHeByERRFzjK3Yw3Pi9PWym:sX33G9I48dHSyw/SP3ym
TLSH
T1CC038DB198A4DEAB5CEBD7C6B7567747EEF00163C5C89994EAC89E0E00C61DD070BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5028_1330272007\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download