f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m2-eM.svg
Size 3KB
Sample260814-ta3rdaaf69
SHA256 f8b98cd5d49b002dac12197f3cc48586c13811d7c326a008e2abc1ea27d94bab
MD5 40ed26c24cc55b701d2198147f4dd511
SHA1 be79a6dd7f18c178a4419eb98dd433ab090071d7
SHA512 6640d83ea0c3300598f061d3914e839c94e0dec416692dbed5dc1e857898e7467011e2e986cc39131cb59505b3705d679faa8e61cff117e12fc356edaceed39e
TLSH
T10271378876F87EEBC78802970E51D4B84B2F906BD822978DD3CB94D8792C2AC735D570
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311963377984313"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{F8E953DB-EE5B-4378-BED7-13C5E9CE0A73}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4516	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4516	864	iexplore.exe	89
PID 4516 wrote to memory of 4184	4516	msedge.exe	90
PID 4516 wrote to memory of 1232	4516	msedge.exe	91
PID 4516 wrote to memory of 2516	4516	msedge.exe	93
PID 4516 wrote to memory of 1232	4516	msedge.exe	91
PID 4516 wrote to memory of 1232	4516	msedge.exe	91
PID 4516 wrote to memory of 1668	4516	msedge.exe	94
PID 4516 wrote to memory of 1668	4516	msedge.exe	94
PID 4516 wrote to memory of 2528	4516	msedge.exe	95
PID 4516 wrote to memory of 4520	4516	msedge.exe	96
PID 4516 wrote to memory of 2528	4516	msedge.exe	95
PID 4516 wrote to memory of 2528	4516	msedge.exe	95
PID 4516 wrote to memory of 4520	4516	msedge.exe	96
PID 4516 wrote to memory of 4520	4516	msedge.exe	96
PID 4516 wrote to memory of 5552	4516	msedge.exe	97
PID 4516 wrote to memory of 3612	4516	msedge.exe	98
PID 4516 wrote to memory of 5552	4516	msedge.exe	97
PID 4516 wrote to memory of 5552	4516	msedge.exe	97
PID 4516 wrote to memory of 3612	4516	msedge.exe	98
PID 4516 wrote to memory of 3612	4516	msedge.exe	98
PID 4516 wrote to memory of 3892	4516	msedge.exe	99
PID 4516 wrote to memory of 3892	4516	msedge.exe	99
PID 4516 wrote to memory of 1424	4516	msedge.exe	101
PID 4516 wrote to memory of 1696	4516	msedge.exe	102
PID 4516 wrote to memory of 1424	4516	msedge.exe	101
PID 4516 wrote to memory of 1696	4516	msedge.exe	102
PID 4516 wrote to memory of 3188	4516	msedge.exe	104
PID 4516 wrote to memory of 5904	4516	msedge.exe	105
PID 4516 wrote to memory of 5904	4516	msedge.exe	105
PID 4516 wrote to memory of 4648	4516	msedge.exe	108
PID 4516 wrote to memory of 4648	4516	msedge.exe	108
PID 4516 wrote to memory of 3420	4516	msedge.exe	110
PID 4516 wrote to memory of 4080	4516	msedge.exe	111
PID 4516 wrote to memory of 4152	4516	msedge.exe	112
PID 4516 wrote to memory of 4164	4516	msedge.exe	113
PID 4516 wrote to memory of 4164	4516	msedge.exe	113
PID 4516 wrote to memory of 4112	4516	msedge.exe	117
PID 4516 wrote to memory of 4112	4516	msedge.exe	117
PID 4516 wrote to memory of 3244	4516	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m2-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m2-eM.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa7521c188,0x7ffa7521c194,0x7ffa7521c1a0
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,5112480189861079401,15325369084679913260,262144 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7256863912926552491,32699860046620097,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,12090834070146291600,5895300958166751581,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,6771098130089212658,17134113932157673524,2097152 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,4981863027255703784,7149768252415221494,2097152 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,17951628174431440742,1029760525744340465,2097152 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,7556882351971101187,16877873873979054348,2097152 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,13185611293873557143,6089708756533088891,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,11658589627185549550,16369393037923580341,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,8667890234918483727,16045979095694396187,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1655413844953188612,13227058702424865255,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1655413844953188612,13227058702424865255,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,9120842777028087073,13234426944805751820,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,13475759096515387662,12807473878606610908,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,268646574768847958,14799440518863327703,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9609866362745770606,9785802672114253537,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,15714758931763026064,10831763293541017751,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,14280387114689514644,10523128113435430112,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,3617205485600798294,12649076423839654460,524288 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6632,i,13837693716048218881,17752758942066529678,262144 --field-trial-handle=2536,i,11397312300703823519,2421103817292460949,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

4b2fe8fe-6a0f-460e-827b-48abc929f768.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b2fe8fe-6a0f-460e-827b-48abc929f768.tmp
Size 11KB
SHA256 b775493ea6ae41510c517dfefab90862cf8f6d995b0ee90241b1d8b23dc856f5
MD5 ddad66585851c4cfb71d5b99723ea537
SHA1 a91f48282a8e7fb830e371abb7e59e1e69d6a490
SHA512 505bb2a65991210aaa622065bca823a458dac440fd92982ee2cda6aacc1ab16dd93e6a7d7d2fe8b1d4da041cd86696f87d2e19f36ebe063a6efe5467e04bef29
SSDEEP 192:sxRiR/CF/fHsWoHjuZL8XzVzoA8p4j/g6+WNIYE/XiKxGPIgVFJ:sxRi8F/fHspjILEz42/5IeTN
TLSH
T1BC32C8156D68A93B5CC7E21DBB65BF53E2F91032A1D41E48FAFC861C04E6ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e998039bf0e7853c0c67a572f7f6b03a888b684c0e1219d28485ed648d0ded7d
MD5 3226df8657a8aee2080370c3d38e1193
SHA1 5a07a3c7e86891567feae40eed8e3accdb2adb58
SHA512 6249878cadd184225a393bb73af0593ac15e0fbb660f7ba1d4faeb7fc2b4f2a85ac3b5eda9d9049aa6f90afa6b3fbaad9f40ff087c300aabb2cf770dabe59bf8
TLSH
T104518481A3230BFAD3D179B154EAF0893E3CE49DC5076EA7884CEC787987314155A7D2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599503.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599503.TMP
Size 2KB
SHA256 16f9b847d8fcf5d1ada5ff4c0349f618ef3c999e179cb16f2c01c70cc0a58489
MD5 596fac0aa38f4f1350f4a5dff9da27d5
SHA1 899f8d2b4ab669ac45efca76b5aa82699ae7346c
SHA512 c835b35c1bccf6e0c8f37121b1a27fdce44ed7fe6703caac9c6f49e0b475c1bfd91fbc6b2838e69042cc335630552d86aa78cbd75d6e30597d2b89fa406a6951
TLSH
T195518281A3230BFAD3D1B9B154EAF0893E3CE49DC5076EA7884CEC787987318145A7D2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7595f4285617bd6af7f5f9c7d82bac27beb9e8b4c4e2c86816f519aacf39b621
MD5 1252530ff477b7e318eb83b9af42c6cc
SHA1 90cd590f27cf59469f3bba80f3ae9a0c9b6a5f1a
SHA512 db08d26aa339c7cc641df065f21ff2a0134901008105d6f9e0ee5f940cb868a780f7df884891f089133cd90ebcd2bfc24db118f1ee21664e6024fd68ca9be02d
TLSH
T1A141C0F383F4857D8A0156F0AB146E1FDE2D0515432C7D9A89E0AE2B93F3471E045A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5ad817f8d07a8fb5a6aa015a0de8c4e930d3b13ad870fe82b855c8f1ab9f9627
MD5 5a0c6ff9a174b7402ee4f7d808857114
SHA1 fe932aac0ca6468615715c943c828c0d86dbdf96
SHA512 8f398473110ec8f4f5ead6baae54f5d1ef5d4f2e854c096dbe679e59f514acb57e94826a08e2ba45b34b5b9e759d4c8f285defa5aa4d12911701aaa75f8cd316
SSDEEP 192:sxR1R/CF/fHsxoHuuZL8XzVzoA8p4j/g6+WNIYEl7iKxGPIgDzFJ:sxR18F/fHsauILEz42/5IAT3
TLSH
T15042C8156968A93B5CC7E21DBB65BF53E3F9503261901E48FBFC861C04E6ADD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4518e0524cb4994d8d34485bcb27889369d5f21e9cdcf32d8d75cf915cb60eef
MD5 949fc077cd68ca2139f2ba7457bbc2d9
SHA1 8ae122f2b92f6401a9a8e962f329ddb63f77f116
SHA512 80d86530524f2558dd51989e2d32ad8216254cdcb4ff0ad9e170e4b1754aa8053550b26bb35e9bc40189d9a4c39be53c70fa5efdba9ee165825e755e7020e5cd
SSDEEP 192:sxR1R/CF/fHsxoHjuZL8XzVzoA8p4j/g6+WNIYE/XiKxGPIgDZFJ:sxR18F/fHsajILEz42/5IeTN
TLSH
T1E442C7156A68A93B5CC7E21DBB65BF53E3F95032A1901E48BAFC861C04E6ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 798ebe2f11fa194ea8e18b4bccba0be594d2cbd8e7e5663fd26ddc4fd1643545
MD5 77c3096113908cde2feb201474235495
SHA1 4caafad49c02f4dd86fdb5db23263c55beb89725
SHA512 e404ed18390ca5208a7068782b28e149f081bacdc6d63d52148c1d5039a58f824405a172853afff91764544f996e06325bb5e3f77a4e73d3a0c798cedb02c633
SSDEEP 768:0UQibW7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUu2OVqOroO6J:0UQib2E7PaWgH7feQu1jabu2IqFB
TLSH
T122D2EB7B640CCB7F4F804ADDEC197E9A6DA802CB9698CD8047FA945C03C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc20ba46-3496-4682-90fb-c02838f8ca50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc20ba46-3496-4682-90fb-c02838f8ca50.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2ef1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2ef1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cf31a5f5559dae3d2c2bbfcd0b14c1d7f1bff9d39df6e688ad854c3653e3bcd9
MD5 376635951f34d8d31b3b9d3f10760711
SHA1 e8b1cf19aa5d9d6f292882955885ece322a198c3
SHA512 880f6f7b2d48856cd3fe7f5e85fa43030dc5950d8e824b8ce39766fe2e8c85be6042e2a1942759135a41a5ced76518a727013816e40e04d870f91df6ad865b5f
SSDEEP 768:RU3KuqGTHDp+MK48dHeByERRFzjK3YLPi9PsE:RU3KXGHY48dHSyw/VP4
TLSH
T137F2BFB0A9A8ADA34CEBE34A76537757EEF40163D0C85A68D1DDDB0E048359D070BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6f4af6c2c88b6e2dcccbe7b5d10a976c3569fdf9a90f54c1d4736014cf7b31a0
MD5 fc42327cdb0246ec04057edc7929951b
SHA1 deb0955824a0617858b4930f5b48bf9331a08722
SHA512 83b8152fd37ba224715d0094f2de0130e123098326ef64003491a33f41560b5dd2960452066d4d212ced14585c78a1a9dceb092e744e7e971fb3dadfaacdccbb
SSDEEP 768:7rv+4UNbdf3KuqG6HDp+5K48dHeByERRFzjK3YLPi9PsqI:7bsbx3KXGyj48dHSyw/VPV
TLSH
T1EF13CF70A9ACAEB34CEBE289B2437747BFF4016384C40B64D5D99B4E44875DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d4246659946aa4c973459c4051a62513b505b5b1aa6784e29bbc3e0299df23c3
MD5 983b2338e2fecec6ff003d12bdbe126a
SHA1 098180259226b7911eb1f7155cfbd18a48303180
SHA512 670b0545c3ac6adc64fa512b4770fcea0499fdaa41f83758c9f66ef724ad8692e0be61ec8b48408eba96a37d5c9345c5e6cefe1c76eb1d975449cb83a9f1381e
SSDEEP 768:qrv+4UNbdf3gqGVlDp+iK48dHeByERRFzjK3JLeVH1SCj:qbsbJ3hGT648dHSyw/yEH1Z
TLSH
T17B03BE7098A8AE734CEBA28AB1837657BFF4016384C44B64D4DAAF4E45874CD170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b088c9718cdbff47107219445f1f7223452cbc4937dd1c9921067f43576b55e9
MD5 598e188c019f2af30489bf57f844add6
SHA1 3ed1a02c97c73a6fc54dad0848231f84073259e1
SHA512 f8b3a1d69dba6d0a67d0bc73c7f42fc5511fe91198b07c44e3b812ea7d63a43c7ba14b654a1fb73f0ae1359e4dda26a79a55e1f084c40b163f2f4572ecdff7f4
SSDEEP 768:iU3tuqGTHDp+MK48dHeByERRFzjK3YLPi9PsE:iU3tXGHY48dHSyw/VP4
TLSH
T1D6F2BFB0A9A8ADA34CEBE24A76537757FEF40163D0C85A68D1DDDB0E048359D170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7eabe89f8227f4a8947ea77cc58f5490e86784a378a96ec07bc898fdd9c0542f
MD5 5a61a8072b276ec4ec72d39549494e77
SHA1 ab85ce3c8656b2e40e4f64cccd14a63ecdac2043
SHA512 c164118a55c7bac8b57335c0cee64ca394ad8ae14822ce45f0cd6a4f26a7e4f8300341a4e01c3861a789f037800784c3f71579a81397fc4a27fc81af61fa1311
SSDEEP 768:XFQx3owg8uqGT7j+0K48dHeByERRFzjK3YLPi9PsE:qx3nXGa48dHSyw/VP4
TLSH
T156039DB1D8A4DE676CEBD786B7527747EEE001A3C4D8A9A4D6D9DE0E00831DD070BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 682cf08f1c020a2bcb2a967819ba64ece170da9ee264f2c4d5af15e0ad28b8c6
MD5 d4086664abefbf5ed9e4c1706dd7eda2
SHA1 6bf733cf770342da0d3a5f37850b4ca6122a8e0f
SHA512 91785b5809d0497a67c69b45a3c7e239f720b95425edb79ebbc62bf7cf997b84722532c2f0835a6df81aa9cb30970ae73e9851891bf64c206eb855e314ea8719
SSDEEP 768:Qrv+4UNbdf3lqGQHDp++K48dHeByERRFzjK3YueVH1SCj:QbsbJ3AGAe48dHSyw/QEH1Z
TLSH
T17B03BE71A9A85E735CE7D2897583761BBEF4411385C81BA4C0DEAF4E858B4CC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4516_1461227041\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download