2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v15O-m1-eL.svg
Size 44KB
Sample260814-d6341stfqa
SHA256 2356f4f2b651efbad7c8ee7f8e4dcaa51b9ce28d95394fb3a5254447f93818e1
MD5 2afb4097fb2218401ce6072aa93f8307
SHA1 faf6a9c1effa6293ec2021eac520dce00486f4e0
SHA512 f66dca04fa73cbae407bab6bcc97525d8d397ef065a220094ce93dcf717293611e9f00d05915fc2d4c5bd63b27ce5714f07b8b27c62cc32ab4efccf5b81dd84b
SSDEEP 384:c827NHdmDcvlxO4fnH5AomEkJW9mOx790u+wycg9+fiUCFRlg0vlg90rf2:c/NHMWaA90C
TLSH
T1CF1340B537F43C9B8BCC034B6D42FC6C46BF94B78458668C9BD790E89548368B7AC5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3884	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311523001445032"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{65B0C9A3-E9EF-45D3-89D7-3B6E21492892}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1856	1964	iexplore.exe	89
PID 1856 wrote to memory of 3516	1856	msedge.exe	90
PID 1856 wrote to memory of 2588	1856	msedge.exe	91
PID 1856 wrote to memory of 3884	1856	msedge.exe	92
PID 1856 wrote to memory of 2588	1856	msedge.exe	91
PID 1856 wrote to memory of 2588	1856	msedge.exe	91
PID 1856 wrote to memory of 252	1856	msedge.exe	93
PID 1856 wrote to memory of 252	1856	msedge.exe	93
PID 1856 wrote to memory of 4812	1856	msedge.exe	95
PID 1856 wrote to memory of 4812	1856	msedge.exe	95
PID 1856 wrote to memory of 4812	1856	msedge.exe	95
PID 1856 wrote to memory of 1640	1856	msedge.exe	96
PID 1856 wrote to memory of 1640	1856	msedge.exe	96
PID 1856 wrote to memory of 1640	1856	msedge.exe	96
PID 1856 wrote to memory of 5108	1856	msedge.exe	97
PID 1856 wrote to memory of 5108	1856	msedge.exe	97
PID 1856 wrote to memory of 5108	1856	msedge.exe	97
PID 1856 wrote to memory of 1876	1856	msedge.exe	98
PID 1856 wrote to memory of 1876	1856	msedge.exe	98
PID 1856 wrote to memory of 1876	1856	msedge.exe	98
PID 1856 wrote to memory of 3320	1856	msedge.exe	99
PID 1856 wrote to memory of 3320	1856	msedge.exe	99
PID 1856 wrote to memory of 900	1856	msedge.exe	102
PID 1856 wrote to memory of 2392	1856	msedge.exe	101
PID 1856 wrote to memory of 900	1856	msedge.exe	102
PID 1856 wrote to memory of 2392	1856	msedge.exe	101
PID 1856 wrote to memory of 3000	1856	msedge.exe	104
PID 1856 wrote to memory of 2004	1856	msedge.exe	107
PID 1856 wrote to memory of 2004	1856	msedge.exe	107
PID 1856 wrote to memory of 2688	1856	msedge.exe	108
PID 1856 wrote to memory of 2688	1856	msedge.exe	108
PID 1856 wrote to memory of 3924	1856	msedge.exe	110
PID 1856 wrote to memory of 2164	1856	msedge.exe	111
PID 1856 wrote to memory of 5968	1856	msedge.exe	112
PID 1856 wrote to memory of 5448	1856	msedge.exe	113
PID 1856 wrote to memory of 5448	1856	msedge.exe	113
PID 1856 wrote to memory of 3112	1856	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v15O-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v15O-m1-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd1d33c188,0x7ffd1d33c194,0x7ffd1d33c1a0
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,3616618740487416829,11896044451699889203,262144 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10515419224953733736,7217018485590134406,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,17232856789073472917,6147591397054183903,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,14936953255690709291,16444521197540909609,2097152 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,17707994927923844020,20109923580833689,2097152 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1426650533413142956,2550527877269377436,2097152 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,4353841079367389075,14360593855666902222,2097152 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,14660648525431114679,6887396579809067035,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,9957436423935960249,12870237008328017410,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,14825489432366837107,14750945707297817923,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,9579961588303385774,10016809935429912700,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,9579961588303385774,10016809935429912700,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,2301164967448399145,2096593361588203969,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11051492522763897736,15836810142283617247,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,9526794240506358967,16364787607630727862,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,897399785757811827,3187614758217048476,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,383715870115409858,1566967284727319026,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,13566017137885598569,13050415213705558774,524288 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6104,i,5450198775826101714,8356978046160473421,262144 --field-trial-handle=2348,i,11238447739152624319,9411680460932972159,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9fb36e6720ef8bd334108ed325b372b0c750144742b0ecc33e786a0074930486
MD5 64ea3f496106123dc83d5e3779f9b9f0
SHA1 cd1d83b2cb66e3f2b2f1072d1f88f7fe9563d3c5
SHA512 9344da2bd41a86e64e21a0667564c1df5d81610f7ad53dbf8c539b1b34301a12d2aedb02c9f73eaf1c7cb74fd0d4c7b5800fc215c3cb465218b061347266c4bc
TLSH
T189410D58833CDFCDDBA409B1BCF0D6843ABE98CE0307AE50D4A41BBC5A02B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a55e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a55e.TMP
Size 2KB
SHA256 5dd0b31b6874bb2ce17bb3f92bd660c255bf4edf5e25f044ec15817f23e6f103
MD5 02cc03615fce22923dc7e0be6d6ed655
SHA1 d1f8940518773f6a13716ffd0fd57a0971d2bba4
SHA512 071393c417c16eaee5d074f2d0b745b393ec45457ee5671fe5b35ba32421534decfc23f6c9f8520a8d985b42e676f5f49b268b7a7f657ee75c4f3721645e1766
TLSH
T161411E5C833CDFCDDBA449B1BCF0C6843ABED8DE0307AE40D4A41BBC4A06B8459A1193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1edf29c42a15458b1b01075d7e1dc1654f68026f0c963eaad7d1db8c13451843
MD5 21fae8886e91b5f7e938339228ee3266
SHA1 af31ade3d3e727430aee77f270afff7a31861b10
SHA512 70b70e607c848fedad64f2c1cebf1cad0d6679f15da0a89c21c4a0b72db76b28a545eadf4e610d1e0c8735395f6984ff98f298ec25e7349ec82a1b9b92eee196
TLSH
T193417FF783F4856E890155F0AA14AE1BCE1D0515432C7D5AC9E4AE2793F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a5c10364462d1291c4fdb71e29c31265c9deb03bb4845d8be02e05f8cef1cf1c
MD5 735a6f9f27906d0de04b975e9deeac6b
SHA1 632470993a3ba6bba411fe628e3866bbb4312801
SHA512 d80a6ec3f40fc7870d027b966caaf6cc813918e0da867ea3c467d4c4490a1c5f820461af9bf8c922cba74b51a65ac1e68c83328337dfeb769e4186a2b3de8b52
SSDEEP 192:sxRER4yM/jK1Ml8UQKCY/fCsYUhEsPoZX1zoA8pe9/g6+WNIYn8sBhEGcIgDPI8J:sxRECqtY/fCsYUtWIu/5ITMAz
TLSH
T14762D81A6A249977DCDBD209FA517F53D6F81573E1901E44AAFCDA0C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2ec849a8b33e761b7ad649b7aabb8c9b3315499ab28ba6f5b18ddce6f35bf58c
MD5 6dce06468fdbbc292225e71b6f9dd8b9
SHA1 c76731a006497841c2e8492c67d0e56a2bd53a4a
SHA512 e9eb6980720cce4684dbafd547dbe8f6303c00a4aaad6fda6458446b552c82b455f96c18ff9f5885c8729e5154319c5b402c411572d2f2f623575a29dcb2a3d9
SSDEEP 192:sxRzR4yM/jK1Ml8wCY/fCsJhEvPoZX1zoA8p49/g6+WNIYn8UZhEGcIgVI8J:sxRzC8Y/fCsJkWIQ/5ITaAR
TLSH
T10962D7196A34A977CCDBD209FA557F53D6F81563E1901E44AAFCDA0C00E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 770af8e66c3e8c9958a72a391c31661779ec0a69190537ed5f33e4ebb5aadcbe
MD5 b3c9752bf4ceca6acf332e553d55fe4f
SHA1 c6db2ded948fb5ca0e10d4069dde0b1c43eeed16
SHA512 f5ce0037b1b4a9213d09ec11bee8cd26b8e482cbfb0773e1fe8b7b3e798fb4d32cf39b5f341fd5beefc0bcafde9eb4243350028912d4e9d09184efc4d586b94b
SSDEEP 192:sxRER4yM/jK1Ml8wCY/fCsYUhEvPoZX1zoA8p49/g6+WNIYn8UZhEGcIgD1I8J:sxREC8Y/fCsYUkWIQ/5ITaAl
TLSH
T11F62E81A7A346977CCDBD209FA517F53D6F81563E1901E44AAFC9A0C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 24212f24d1f7560ff97a4a01d36a9fa35dccc51a58542ee08df5eaff8bdbffc5
MD5 c043aef8f9bd21c0b2cd92663e135751
SHA1 3e9360846e84a7e5cac3fcf1f41565856022e127
SHA512 505ec383d7892030cb7686672883f5e4cf1b2b3a3f435ebe251dbd6951040e2988fb894181f80f2d0876ad93e27fc870873d2f348999d7ebc333f5a2525ce8b5
SSDEEP 768:wGedKg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCZOu4YBroSX8Nj:wGedKsE7X6WgoufDMu1ja1ZOVY6Fj
TLSH
T1B2E2EB3B680CCB7E4F804EDDEC29BE9EADE801CB56D8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c26b84125990240c9261740751eea9fffece929a3542f07fb7763bf1a8f9ed7c
MD5 f80a9a719068c8d10e72ebd8c88f22ae
SHA1 8cac3f79efdcf895b6b125612e7514e89565cf74
SHA512 5463f51c881302d1b708a53946bb4137b7776a7f33d7cbd27df40481afc5446f8d025db35bbc6c7539b47c5ad97422c5575921f8e535ef743b122ceeb4605f64
SSDEEP 96:KRwBUAyeSIWWLbgIIK4Ng6Icoob6AFHjsJ9rhhdW18qgjbK4igtbcx50HPoHpm3M:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhY
TLSH
T1F191D555317E02403C7EAA0981F99D2AA3D178E23554B42F7BE901E64F66F038EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ade5590-c1de-486b-988e-91c77441718e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6ade5590-c1de-486b-988e-91c77441718e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 39b8c5dc4bfb767149ea48e0b4e93cffb92f71fd8f24eda0c83718292f9b387f
MD5 3c7aa3caa176683c55f840e91af536ab
SHA1 98e92fef022465780e52e5473d5761c5c78347e8
SHA512 5136666cc582ddc0c4d51ec4474f9738ccea58ffd47ff24b47ba14830de8d91759c0a0de3fe1d00f93add23395e3c96462d4938581e14caffa99130be84a30e7
SSDEEP 384:nnZcIr38NkJ7n04itxCJDZNfNoXOVSUUWXnFLXoabjETRzcoXfK86sfxEZxxsIjf:Pr3w9mDZIO0WhTMNzc4ReyIsPMPi9PPW
TLSH
T11CF2BF71F828DCA3ACFAB746B6463642BEF51167C1C41E84DADC9B0C094329E175BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 afba1b1693b8046e95b9068688aa15bbe3b5f9bbec0ffecb8d45b7895b37914e
MD5 c8f1ac4fb61691cb796204c8fb5a5552
SHA1 8247220033efa0700130d53b3873b3061f091092
SHA512 f5f8b1781f4fa7089dcee9a2f7b63c5d6ab99bf674dbe5f801607761906d109cd832d8da01cfbc327a5c7950e52509b7ad5d46c03904e4002f283f2b58950047
SSDEEP 384:zkZcIr38NkA7n04itxCJDZNfNoXOVSUUWXnFLXoabjETRzcoXfK86sfxEZxxsIjf:Or359mDZIO0WhTMNzc4ReyIsPMPi9PPW
TLSH
T175F2BF71F828DCA3ACEAB786B6463642BEF51167D1C41E84DADC9B0C094329E175BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a4faf54c86f00ee8aaba8eb8a3d8dccac1a8f170457397dd9b8e6e9aac3853cf
MD5 11cd9a784f1f94b38a3a113d07e4d9aa
SHA1 e75d2c7f604f6b1deed6bdc2b7954d87296d2dad
SHA512 ca5a1ac0940ee6d31bc92128ab5e025276bec9d7788cd588dfeffdd365aeeb0da63e6d3c6da238efd7f0b5b83631d1d82b2f43f3bb4eccd0171c2ca72d10f84e
SSDEEP 768:6rv+4UNbds3TPDZIO0W/Nzc4ReyIsXoeVH1S5D:6bsbS33tc44bs4EH1Y
TLSH
T15C03CF32E8788977ACF66785B50B76533EF8912782981B90C9DE2F0C4A4B1DD131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4441bbf623d498d24fc5dcb65d931bf1a4636605da0269d79b9c656ee673ddb8
MD5 1b5ef9a3fa6a84bcae34d5a9eedfad42
SHA1 72552bb4e69c2d9b5716fa9b81ed4972a324e099
SHA512 030213c38dc7847dbfc9e4d52acec231ae6158bd9891792d082eb4a1df0d21c83284935007876f7fd20226cadefe1afb7db959ee9f51ad7571fb6edcae26ba42
SSDEEP 768:Jrv+4UNbds3OwDZIO0WhTzNzc4ReyIs2MeVH1S5D:JbsbS31ztc44bs7EH1Y
TLSH
T10503BE32E838DD73ACEA6285B14776937EF8616B81840E90C9E95F0C4A471DE175FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 03f173e71b77130523a719a8bf38a20b5c0a5d59596adfca8a4475c17b58787c
MD5 8a71f459a504197aeaf84431b5194adb
SHA1 d50789a0b697ea10e5f9210f0c27bc1804888e7f
SHA512 6a38ddd0d03d3d68e00f3a96f4bd4d109ede9d4aaa2403c7a5b1377e11a11bffb29a2e3db4618da55371c4d0ec93ec1f96e08ff605682e42f216d9e8898386f4
SSDEEP 768:Krv+4UNbd835dmDZIO0WhT1Nzc4ReyIsPMeU:Kbsbi3e1tc44bskD
TLSH
T10F03BE32F828DDB3ACFA6246F1073A837EF811AB80C41E94CAD95B4C454719E275F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 26d9380d130dcdf483b01b27f5afb2c59580744436ae5236cf24aae7138cacb9
MD5 f7aaeb2a19947f644f7afe99200722b3
SHA1 1975a57b943b76cfee9b0441d38fc1d5755458e1
SHA512 cc696e0c16f4c58e5ce45c69aef63d684c9466c364aed4f6148235c17264a9fc87d1ce3e3f24660705f5f6b79561debfc6e61b9f3f3f850fd03ea9d172a75d07
SSDEEP 768:oFQJr3LwgU9nZQ5O0WhTwNzc4ReyIsPMPi9PPW:LJr3Ywtc44bskPR
TLSH
T1EC039E72E864DDA7BCF66786B7067646BEF011A7C1D86DD4DAD89E0C04832DE074BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1856_767295873\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download