c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m1-eL.svg
Size 3KB
Sample260814-smbyrawzhy
SHA256 c2f5b199320bbc3fcff20bef28f02acbe7697e2a9d1afe31bf7d66b180423a31
MD5 2226f49d0e59c46b4a18649eb679ae54
SHA1 c969dfea4218c1fab67060e9393a7fc24cc5547a
SHA512 a155996290a9d678506c7112a083decaa035069718b565052611fd751a1fb9378bb55dbdb09a8fabc2a0f5caa91dfbc2eb1e106fb2f9cba9c2f00608c0720af7
TLSH
T1C771368876F87EDBD7D802570D41D4B84B2F906BD822978DD3CBA0E8792826C735E5B0
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1524	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311940586360803"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{D118B73F-30D7-488D-9126-38A5D77E7481}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5152	msedge.exe
5152	msedge.exe
5152	msedge.exe
5152	msedge.exe
5152	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5152	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 5152	4508	iexplore.exe	89
PID 5152 wrote to memory of 3000	5152	msedge.exe	90
PID 5152 wrote to memory of 1372	5152	msedge.exe	91
PID 5152 wrote to memory of 1524	5152	msedge.exe	93
PID 5152 wrote to memory of 1372	5152	msedge.exe	91
PID 5152 wrote to memory of 1372	5152	msedge.exe	91
PID 5152 wrote to memory of 3020	5152	msedge.exe	94
PID 5152 wrote to memory of 3020	5152	msedge.exe	94
PID 5152 wrote to memory of 1252	5152	msedge.exe	95
PID 5152 wrote to memory of 1252	5152	msedge.exe	95
PID 5152 wrote to memory of 1252	5152	msedge.exe	95
PID 5152 wrote to memory of 964	5152	msedge.exe	96
PID 5152 wrote to memory of 964	5152	msedge.exe	96
PID 5152 wrote to memory of 964	5152	msedge.exe	96
PID 5152 wrote to memory of 2616	5152	msedge.exe	97
PID 5152 wrote to memory of 2616	5152	msedge.exe	97
PID 5152 wrote to memory of 2616	5152	msedge.exe	97
PID 5152 wrote to memory of 688	5152	msedge.exe	98
PID 5152 wrote to memory of 688	5152	msedge.exe	98
PID 5152 wrote to memory of 688	5152	msedge.exe	98
PID 5152 wrote to memory of 2832	5152	msedge.exe	99
PID 5152 wrote to memory of 2832	5152	msedge.exe	99
PID 5152 wrote to memory of 2180	5152	msedge.exe	101
PID 5152 wrote to memory of 4736	5152	msedge.exe	102
PID 5152 wrote to memory of 2180	5152	msedge.exe	101
PID 5152 wrote to memory of 4736	5152	msedge.exe	102
PID 5152 wrote to memory of 5872	5152	msedge.exe	104
PID 5152 wrote to memory of 4868	5152	msedge.exe	105
PID 5152 wrote to memory of 4868	5152	msedge.exe	105
PID 5152 wrote to memory of 5012	5152	msedge.exe	106
PID 5152 wrote to memory of 5012	5152	msedge.exe	106
PID 5152 wrote to memory of 2028	5152	msedge.exe	110
PID 5152 wrote to memory of 1068	5152	msedge.exe	111
PID 5152 wrote to memory of 1616	5152	msedge.exe	112
PID 5152 wrote to memory of 2780	5152	msedge.exe	113
PID 5152 wrote to memory of 2780	5152	msedge.exe	113
PID 5152 wrote to memory of 1136	5152	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m1-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m1-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa974dc188,0x7ffa974dc194,0x7ffa974dc1a0
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16082055627663619027,1270159592821956885,262144 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3765446714726092640,17789102981095798555,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,14398674070143441201,16032489402068276802,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,2289696796415435187,6543277104948190580,2097152 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,7551726036354894994,14442846700294649632,2097152 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,5457767140289807774,10205042779435326325,2097152 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,5369009890475348562,16065578472179581187,2097152 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,4722311984128591252,392245732063313946,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,13065472393287902692,11680570224204019690,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,2730068055379874752,3507948727037794102,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,12086832615534731728,14467429841688713317,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,12086832615534731728,14467429841688713317,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,1940833078419354708,2961536863808357534,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,10882358375494494638,8004409548271368991,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,15613592206226131789,961707287074065972,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,8897027668489934973,3018137940593173574,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,11461669047194999240,16941809190886776779,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,13372810940791352878,14489688483859289570,524288 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=944,i,17579973917771269650,12036296869486295845,262144 --field-trial-handle=2296,i,17590373159046795635,14943084316690418939,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d9a55ac43f55004f895aac44066471a19807615d2092bd066cd1f1fce8c13fe9
MD5 a4a7fa182b7102238e430608e542d61a
SHA1 1e80ab3c0110c131e017f36ad68e6d7debe08a23
SHA512 c74e16290193c2ff1f3f78ebe32c52f5dde2f0df92f05fbff2ca63c8691090c02f78fc8d46aa55c6dc1d326d184d25cfbe02190a572530a60c6d9927f67977d0
TLSH
T1DD6183DB032209E1D7249A7BE0E6245A36F4A4994D7F6E018B3CEF745C46F18A1F092F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f37e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f37e.TMP
Size 3KB
SHA256 1683c32d195beffad0312bfa00f3ff1a91d3aacf88739644facf0749ac718a9f
MD5 3b5761100330092e57a67f52030e60b4
SHA1 a8da30fd113e5daef1495ac081e7858b0d4e67ce
SHA512 fdf0dd91d3076dcd7ecb1694185d6d195d1d4d3e084cceef70b0c1df237d6a82b4ad6161d64d9ff9dea428325dd997d5eef8fe49fda496d4dbad087ddb620e76
TLSH
T1266183DB072209E1D7209A7BE4F6645A32F0A4994D7FAE018B3CEE745C46F18A1F052F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 35d00d78b551b6fbdebc7746ede76b29a3c88b0959bbfe9300775e42cc0e6ae4
MD5 1dbd9e3f810079b5d8ecbb08bc109820
SHA1 50f8c90507589ab92830f1a8e76013e1e50704fc
SHA512 d4f41640953293e85caf424ef40b26341e686788b7b2e058f1a2762c78b3012ae504b80f1702018a669bf3b073f7b49ac984cf94bc437fefe8d3e25a6dcfb91b
TLSH
T1DB419EF383F8957E8D1156F0AA18AE1BCE2C0515432C7D5AC9E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 de943c6a3c2f89ee2dcf89779710597d471860c26d138453e4adfa0fa9817ef3
MD5 50c576dfbe0c8b8a1404ddc482bfa59a
SHA1 55610a0d10a6b3017363c2c303a46bf744b4e312
SHA512 8b5d25a77c30db016ac79faef2f40ea041ddbba788fa06afd9182c845ae9ea0b64a27d5f2b32cea8003d313818c6cb3215af135fe81cc53369be41f946df353d
SSDEEP 192:sxRqhkRfCnCvb/f/msrFRIZvKhSAzoA8p4qY/g6+WNIYEBGqm3d9+GtLgHIIgDNM:sxRdQCz/f+srFR2vbg/5IVwHvDW
TLSH
T1AF42D8166E68A93B9CCBE21DBB157F53D7FD507260905E48ABFC8A1C04E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3cb117ea1ad4695a6d6a5ca83ad5cbe4ffd7eae965ec0658434453a5f3ef433a
MD5 efe460f5583ce8ee92bb725409256eec
SHA1 dc40d1da3d0669ac22f45df498f487c3be388b72
SHA512 6b5e3a2e689ea38246fa6150639d56cbadd6f0a2a0d4114f842970b31a83b5a79d668ad3640abc43670aa3c33b084105077025e12291f9fe151082e8d4d3022e
SSDEEP 192:sxRqAkRfCnCvb/f/mshFWIZvKhSAzoA8p4qY/g6+WNIYEgqY3d9+GtLgHIIgVoJ:sxRyQCz/f+shFW2vbg/5IIHvDi
TLSH
T12332B8166E68A93B8CC7E21DBB257F53D6F95032A0945E48ABFC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 29b61cdf5c6b4e46527d4edce4e2ad52777531002c435c9b0ff64be253029385
MD5 dca749602b1767503121665dd9bee45a
SHA1 1934c886ae1c07cc948d7b7fc0301ae6ab3ef419
SHA512 6a148a1a904d434ca07e1cdb126bea45af06dac5e71a7761a79bbfde58068a5f425bb7dbaf920802a6ad732b1a568e4106251b95c9b85f9cde20d012672cf579
SSDEEP 192:sxRqhkRfCnCvb/f/msrFWIZvKhSAzoA8p4qY/g6+WNIYEgqY3d9+GtLgHIIgD/oJ:sxRdQCz/f+srFW2vbg/5IIHvDQ
TLSH
T19F42C8166E68A93B8CCBE21DBB157F53D7F95072A0905E48ABFC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 97ddd565b516a4e2faaee5848ebe692e1d41d36965e85d35971e5466d2871f13
MD5 d8e28a6835668e76b1ad35f8aaea60a5
SHA1 7484b6a2c5ad666ce46fc72211c83652e876210d
SHA512 a5cca7bcce2bcda1f44cc306379f30e738dac2ae6c2fafd3f2c4a48442987ad77f60e2c0d55fab1c2a971335a88142f9ecdbc74f303ece460b4e22264071cd0e
SSDEEP 768:40Dk6DJQD8YF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKS:40Dk6DJQD8YTE7N0DbWgQ6DjfIQDFu1p
TLSH
T10FD2DA7B640CCB7F4F804ADDAD197EDE6DA802CB9698C98047FA891C02C77EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7c2465b8f3c697baa1d16ce942ea650f0c04fdd3aa520529ca3652b22fb7b4b5
MD5 8f8bf65c16b3a7670b39eff58ffe8c1a
SHA1 7ddd1bc47d16d5baf6d7b0801ecac9526731ca89
SHA512 b2d503d71b530a0547338c943996b150b35c90fe64a18619ce07cb4273aa30264e38bd9485bf03df123cb882b3567f5c4173c6c649cc9ea2acc42cceb44a2aea
SSDEEP 768:ct3qwwvnZ5BaeX6+qTko0u229a4vsT3Pi9PvtV:ct3idvVTVKa4qPAtV
TLSH
T19B039D74E865DE6398E6D786B3067A879EF811B386CC5DC4D9DDAE0C008716D1B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 53ad75633d1f6250a59a63db4c1992a594de8e04a8ffff18a16a0931193cdd3f
MD5 f8e16b6194c1a5c5e3459b24164d01d1
SHA1 0381e270538000b553659da97b3e51de6e0f8464
SHA512 32fb4740a4bbdcd7e7c51536d2d707e13e0fb385101930c49a85d96cc813d16d07e1a3a15b9e6ce63a68ebae8e54a37d72cde8b79317df35b0eda797deec6301
SSDEEP 768:prv+4UNbdG3+FXDTd+Z5seX6+qTko0u229a4vsDleVH1SdW:pbsbU3RVvVTVKa4UEH1h
TLSH
T10503CF32E8A589778CE69785B14B75473FB91173CB880B90D8DD6F0D064B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9e9de519ee82be9afb62d7b9b7699253cb6ea2a84d418905c7915b242e054ddd
MD5 d64e850c07a091ff419702ba6b7cb1ab
SHA1 742fc7083612c6cdb43ee6fdd78a02aab1571caa
SHA512 5dbe27723d846656e6c5cbbed705beed6f323961050f237cb11f2624e28a9aa09b8987aca737b5f5a03048d1561ebb45be145322b95266d12fe6e2eeb0a3d617
SSDEEP 768:Grv+4UNbdG3Oy2DTd+Z5BveX6+qTko0u229a4vsS3eVH1SdW:GbsbU3TavVTVKa41EH1h
TLSH
T11B03CF32E4698D738CE6D785B14776872FB921B3CA840B90D8DEAA4D064B19C270F937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a3d5dc6796eed62a28e556bb17e853c60927db7b9fda6cfdfe5a7bb51d944adb
MD5 b6d97b069af5d6a5d21ca50d4602c5f2
SHA1 a0d2ff5a80e7358caa39e5059cadb19f1897a15a
SHA512 7af3e8a5d90266b8253031ad0329d22b55db30ed3ef477388437d532a88f5a9fbc6144f2a628d839af44fa4bbce4692b4983611fee043a66f36747bfb4f5ceb1
SSDEEP 768:/M3qwwADTd+Z5BSeX6+qTko0u229a4vsT3Pi9PvtV:/M3UdvVTVKa4qPAtV
TLSH
T122F2C070F8659D634CF9E785B21736839EF911B3D6C81A44E9DDEA0D054716C1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ce21a22b889848afbf8ff44e841370e9e0ff2af1ac7fb501cd7dddc3ea7cffca
MD5 cf1717f4e885eabc20f59f1d047945bb
SHA1 3c3698799cb32fd741f40af68cabd18beb501edf
SHA512 e84981856496ac083cac517914317667e4e78b2e6102ec47ca5c5266a72263344a279db692b2fa619e2f95d025001beaad6c623f71a3f6f6654a0d4e7ecc3fe6
SSDEEP 768:JM3BwoADTd+Z5BweX6+qTko0u229a4vsT3Pi9PvtV:JM3LDvVTVKa4qPAtV
TLSH
T11AF2C070F8A59C734CFAD785B21736839EF911B3D6C81A44AADDEA0C054726C1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c4b3f08-8289-4890-b5d6-c76ec3211847.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c4b3f08-8289-4890-b5d6-c76ec3211847.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5152_1996813777\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download