d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v11K-m5-eL.svg
Size 28KB
Sample260815-e3pmwsyfpb
SHA256 d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d
MD5 f2f7df101c9bf5d75ce49d42491e9f8c
SHA1 bfa147420c27f8f75982ba6d99be1b938f30cd3c
SHA512 85aa10c95f787a0460395f4aaaa5184eefa4b66ebfd48e0931d021752560f69fee8e79a0788d026d5c00ca8258cc558db5121631ce5c6bd0df1410ceb6c76dba
SSDEEP 384:ckwQGRNPUTQLwwizqwaowD66Uu9dqbvCK+E9xrYTxkk4sQsDI:c5QGvji
TLSH
T125D24D6437F83C9B8BCC03478D52EC68465FA8B7C498678D97C7D4E8A988368F76C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312417001925840"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{53023005-F6B9-4445-8814-D66EA8358E9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
564	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 564	2388	iexplore.exe	89
PID 564 wrote to memory of 4360	564	msedge.exe	90
PID 564 wrote to memory of 4792	564	msedge.exe	92
PID 564 wrote to memory of 2200	564	msedge.exe	93
PID 564 wrote to memory of 2200	564	msedge.exe	93
PID 564 wrote to memory of 2200	564	msedge.exe	93
PID 564 wrote to memory of 4172	564	msedge.exe	94
PID 564 wrote to memory of 4172	564	msedge.exe	94
PID 564 wrote to memory of 4172	564	msedge.exe	94
PID 564 wrote to memory of 3972	564	msedge.exe	95
PID 564 wrote to memory of 3972	564	msedge.exe	95
PID 564 wrote to memory of 1592	564	msedge.exe	96
PID 564 wrote to memory of 1592	564	msedge.exe	96
PID 564 wrote to memory of 1592	564	msedge.exe	96
PID 564 wrote to memory of 1952	564	msedge.exe	97
PID 564 wrote to memory of 1952	564	msedge.exe	97
PID 564 wrote to memory of 1952	564	msedge.exe	97
PID 564 wrote to memory of 3348	564	msedge.exe	98
PID 564 wrote to memory of 3348	564	msedge.exe	98
PID 564 wrote to memory of 3348	564	msedge.exe	98
PID 564 wrote to memory of 6024	564	msedge.exe	99
PID 564 wrote to memory of 6024	564	msedge.exe	99
PID 564 wrote to memory of 1748	564	msedge.exe	101
PID 564 wrote to memory of 2496	564	msedge.exe	102
PID 564 wrote to memory of 1748	564	msedge.exe	101
PID 564 wrote to memory of 2496	564	msedge.exe	102
PID 564 wrote to memory of 3252	564	msedge.exe	104
PID 564 wrote to memory of 4520	564	msedge.exe	105
PID 564 wrote to memory of 4520	564	msedge.exe	105
PID 564 wrote to memory of 4712	564	msedge.exe	106
PID 564 wrote to memory of 4712	564	msedge.exe	106
PID 564 wrote to memory of 3792	564	msedge.exe	110
PID 564 wrote to memory of 896	564	msedge.exe	111
PID 564 wrote to memory of 548	564	msedge.exe	112
PID 564 wrote to memory of 3552	564	msedge.exe	113
PID 564 wrote to memory of 3552	564	msedge.exe	113
PID 564 wrote to memory of 4136	564	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v11K-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v11K-m5-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x32c,0x7ffffebac188,0x7ffffebac194,0x7ffffebac1a0
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,4828095242989073925,11954221206793108183,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3264,i,8106517172982184980,7562085138815484419,2097152 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,14163802893341090839,11112444342059153332,262144 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:2
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,3577092487561493441,9201140823223359268,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3268,i,16297864345256982964,5839598731394453858,2097152 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5788591767107098099,6992237232431671219,2097152 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,1777241557498392217,2318651832964411825,2097152 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,9679780879001380481,1539941945994058015,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,13759340804001333544,17761018084145786174,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3260,i,8303814548837657910,8284897813197531312,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,818555317960227146,3178698490765649717,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,818555317960227146,3178698490765649717,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,9512530872343614873,8135501541676733637,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,5399486336734398698,260291259576612389,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,15619331275495108528,17662212606653484521,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,8001517753217967531,11262535017959973844,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,14714852042670923102,16386973355318690593,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,12757797426812510736,3434864726608668499,524288 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4904,i,11467150432831481268,3646457442284670343,262144 --field-trial-handle=2952,i,5092656354077786467,2714954982671246470,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 50417dc40c3bdb70584afdd83f7bf49e4d9b4ab56ec502270752ac1edc6fdf22
MD5 5c7246e7c93dff0d97058b4cd42a2e39
SHA1 61c8f6c734b4041e5facac6d7234b7f9bdf37b87
SHA512 2f7db5d06d742347186b3bc3238c92c2b52288f5c8d530ebe265c912428d1988360dd4d1db2c82cd7f24a86bdbf1bd2361f44427c170fd88a25d4986bfb5d91e
TLSH
T1DF51CA13036945E3CBA249F3B7F5F54833F5A89BD2CF9E14A442DE759A86F06A0C016B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a908.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a908.TMP
Size 2KB
SHA256 f2ae393f294fbb6fb950a770e38d04df8c04799f5aeae0a74c0fbae55c684693
MD5 439623da5b102c76d22106719aed5e8c
SHA1 daf07873b967542adc63a957ee1ee35e3aacdd48
SHA512 326c0ceeabb8087bf803eafd427af256495145724568bd2240e475e9624ed6e039669c79600aaa98a96524b36f7f858946ee350e71364b2be93dd465c917ae31
TLSH
T1CE51DA13036945E3CBA249F3B7F1F58833F4A89BD2CF9E109456DE749A86F06A0C016B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 83622a9f3be1520ed1d66a794c4b3688823b10853787c3f36f131a614833d91e
MD5 26994dee1fb597b1904c02699b3616f1
SHA1 4b733d3a5fcf5a3ee8e094ee88f8529af3ce48a8
SHA512 1464a2ea46a5da68db6534ed506bfe7f50be29c1103d3ab20ad49fb1cb0b188cbdd7810bbd89170ca6634701c6792a1dd9155769d73da9ff76f95803a7ce14b2
TLSH
T1BC41BEF783F4857E8A0196F0AA146E1FCE2D0515432C7D5A89E4AE2BD3F3472E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 52d37575cd54e8b33588a79a857a8051031c3b1b69ba31304be4905403907a5e
MD5 1632f8a754159bec4bea5e0173131494
SHA1 710208faaad1dd64abbd4fca4dae3b3a96e1792c
SHA512 0e9a7941a28349f71ba1f4a6f1a78e863d071298a367b88ea6e0b2158195c46dba7c41588d31cd0441f95493f6fa2ab199828270d4b3ba170b1af8ba15e3bc01
SSDEEP 192:sxR3RdCm/fTs0Md3AtzzoA8p4Z/g6+WNIYZFLKL9GsIgVi3J:sxR3Sm/fTs/dBU/5IS6U
TLSH
T10D32B7156E28A93B5CCBE21DBB55BF53D7F95032A1911E48BAFC8B1C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 152c7e7eb0d0e6b9e90be6bcc65c940daf6d91f9d8e6dd921a5a812b6866876b
MD5 d8f22cfeaee24f76f8e87e6a63f91d0a
SHA1 af0016d7fb14a1434a789d55510d8c620558c75f
SHA512 d740c04e448d8f9144038fec8ca1a45a402e9bbc3c2be091b7f6069eb49dd6d4dae8e28e03442d8f2b5fd5d6b994c6c18ee7634cc267cc64abdf12579624703f
SSDEEP 192:sxRURdCm/fTshMr7ZbzoA8p4Z/g6+WNIYZFL/v9GsIgDUi3J:sxRUSm/fTser16U/5ISTz
TLSH
T1A742B815AD28A93B5CCBE21DBB557F53D7F95032A1912E48BAFC8B1C04EB6DE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 41bfe7d22c10da85c45d93771013d723c7b82f97a1c60894cc48fab94b8b2aac
MD5 0ca2ba86f0e9f138b03f21b03c30d725
SHA1 3e1ee41d418d57d569ac965b2d2d42eec4c838e6
SHA512 0fdf52680a15475c370a402765d7cbb4e165f7c52b7bf8540c9dae19570c639df455d8d7bef592a2b844e6173b64d1a2570172e41ce7c0a8a4edd09eea4ff476
SSDEEP 192:sxRURdCm/fTshMd3AtzzoA8p4Z/g6+WNIYZFLKL9GsIgDui3J:sxRUSm/fTsedBU/5IS6B
TLSH
T17942C8156E28A93B5CCBD21DBB55BF53D7F91032A1911E48BAFC871C04EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 fbb56c453b4ab99cadfa1e7a6876ca49bb20eb3951f472bf7609a34f87fd6cd5
MD5 c2fb313540cebd766c5df400c30fb22e
SHA1 9883e5845f800d9e346a355d2429a01b59b71441
SHA512 a58bc76fe4f20f008534b681546c386bf12d675a31f57a5e18e0881e83ed6f19033228d062068850292b899f3187440c778800b118de9850c1e33e840f51d066
SSDEEP 768:K80EZ67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLowLW/roL95j:K80EZSE7FwWgNhfVNu1jaNLogWsL95j
TLSH
T173D2D97B740DCA7E4F804ADDAC197E9B6DA802CBA6D8CD4047FE845C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d0fb14b8c638743a3749d8462322fe7b1c9049b495084d1679afef77d07b7de2
MD5 ae1bcea5810d3867914642551a8b4279
SHA1 97261420b8ac01ec1a7dd318e795df559db3c47a
SHA512 35f3f1e9094eb1c68f8763cdc0d2b4acdf0305e2b086ef192ac92974e86991ae691a6b056d5f462f0b7f0ab1a47587734583e876270880f7f820f64bf94b023e
SSDEEP 768:yFQa32wgwWE1OU1qhX4fouOToPvB2thtA9VAgEPi9Pstq:Ja3MsnnwthtttPXtq
TLSH
T1CD039D72D9A8CA27EDEAD79673097247AFF0006395C49EC4EED99E4C018769E070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 18bb31a6eb598c0cd5c6931ed27aae2bcaeb089908e4127cc444d3bc8dd9a517
MD5 d16b37c48c2eb3505344112679fc88bd
SHA1 34c91a1d3a270b92af41f2ac364014dd4adc0a2f
SHA512 31f44a7ef8ef0fa43c30f0d2a5227c3a0d569f0febfc1417f2263a91b9682de463dd7b48fab6a443b01b0b82b92b2ee8ef01b3780ac9df0569b3ac15830d0701
SSDEEP 768:wrv+4UNbdH3nF+LeSFOU1qmX4fouOToPvB2thtA9VABEeVH1SlX:wbsbh3OsnnwthtteEH1Y
TLSH
T15503BE72A4AC8923DDE6E398310B72937FF4516385800FC4DAD95B4D0A47A9E0B0FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 99b68b63abae98554af9f59aa8341918c810b55a62e3dc698cfc0817a899f68d
MD5 8bd169c3b7d59371816571a82d804e63
SHA1 3769a9bd31b03e017b874ac7b520aa2243e6636c
SHA512 615807c31919948851d3d56022269131c9f51db156da4e7ceee2067bb820d270e631c13559a6c4595c0ec2cf87e6aaec1e12a5d2c66917e2444ae23b62916f4c
SSDEEP 768:rC3K7+LeSFOU1qkX4fouOToPvB2thtA9VAgEPi9Pstq:rC3psnnwthtttPXtq
TLSH
T1F9F2BF71A9A98D53DDEDE799720A3382AFF05123A5C00FC8AFDD9B1D054765E0B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7b05211706ebd55deb465696b951b2dd1543db3d3f8a1e64a6f4606b3f883507
MD5 6a41feef77b30b018b1b0d3fdb1ef5f3
SHA1 90144041c7de8406e4de234299ecdcf0893fb520
SHA512 7b6dca557fa5ddc8af188d90cc5271c4c215fa8be4af8a53ef56242921d4a12e08841c398432d4611f1b6ad4470438788f0a2d388225b7a1c777a27e9d7d5909
SSDEEP 768:KC3n7+LeSFOU1qkX4fouOToPvB2thtA9VAgEPi9Pstq:KC3+snnwthtttPXtq
TLSH
T129F2BF71A9A88D53DCEDE799720A3393AFF05023A5C00F88AFDD9B1D054765E0B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9234bdba3bdd03232cf81bac270f954a287085499f9fae954688bf32e096f9d1
MD5 db6c53ab256eccf50cbcd267b790ef2c
SHA1 cee9752aeaf62c843f4ab487eb382c3af76afd64
SHA512 c9365b819ae256416a205f15dc9d176bfdb044f13173588a966f2c8db9ecd50352568b499741c067b1e1df54c1ca99b3f2b5aff242a358fe73c0737072a92ec2
SSDEEP 768:grv+4UNbdH3Lg+LeSFOU1rX4fouOToPvB2thtA9VAw+eVH1SlX:gbsbh3jsnnwthttTEH1Y
TLSH
T1C203BF32A8A88933DDE6D398720B72533FF4911396900FC49ADD1B4D069B9DE470BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ff66c59-c613-4cf8-9d1a-81b9951a2153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5ff66c59-c613-4cf8-9d1a-81b9951a2153.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir564_614972565\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download