66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m0-eL.svg
Size 3KB
Sample260815-zfv7datyex
SHA256 66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73
MD5 95b7e2e1d8065db4ac2ce8927e95981e
SHA1 9f303ce03119c2588fcbb4f320794622c61045e5
SHA512 88d142db6604e75c03e021e409b771a60808f39568002c877a1bb39f1dcb57f89da8c819bd1a76d8cb929edd7c1405165884108a2abca02f298c6a497219887b
TLSH
T1E871268876F87EEBD7C802570D51D4B84B2F946BD822978DD3CB90E875282AC735D5B0
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
236	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313000199839575"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{7186BB1D-56E1-4429-B65B-E49378C1458E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 2416	5496	iexplore.exe	89
PID 2416 wrote to memory of 1556	2416	msedge.exe	90
PID 2416 wrote to memory of 236	2416	msedge.exe	92
PID 2416 wrote to memory of 1248	2416	msedge.exe	93
PID 2416 wrote to memory of 1248	2416	msedge.exe	93
PID 2416 wrote to memory of 1248	2416	msedge.exe	93
PID 2416 wrote to memory of 4320	2416	msedge.exe	94
PID 2416 wrote to memory of 4320	2416	msedge.exe	94
PID 2416 wrote to memory of 3148	2416	msedge.exe	95
PID 2416 wrote to memory of 3364	2416	msedge.exe	96
PID 2416 wrote to memory of 3148	2416	msedge.exe	95
PID 2416 wrote to memory of 3148	2416	msedge.exe	95
PID 2416 wrote to memory of 3364	2416	msedge.exe	96
PID 2416 wrote to memory of 3364	2416	msedge.exe	96
PID 2416 wrote to memory of 3772	2416	msedge.exe	97
PID 2416 wrote to memory of 3772	2416	msedge.exe	97
PID 2416 wrote to memory of 3772	2416	msedge.exe	97
PID 2416 wrote to memory of 2492	2416	msedge.exe	98
PID 2416 wrote to memory of 2492	2416	msedge.exe	98
PID 2416 wrote to memory of 2492	2416	msedge.exe	98
PID 2416 wrote to memory of 1820	2416	msedge.exe	99
PID 2416 wrote to memory of 1820	2416	msedge.exe	99
PID 2416 wrote to memory of 5512	2416	msedge.exe	101
PID 2416 wrote to memory of 3020	2416	msedge.exe	102
PID 2416 wrote to memory of 5512	2416	msedge.exe	101
PID 2416 wrote to memory of 3020	2416	msedge.exe	102
PID 2416 wrote to memory of 2064	2416	msedge.exe	104
PID 2416 wrote to memory of 200	2416	msedge.exe	105
PID 2416 wrote to memory of 200	2416	msedge.exe	105
PID 2416 wrote to memory of 1292	2416	msedge.exe	108
PID 2416 wrote to memory of 1292	2416	msedge.exe	108
PID 2416 wrote to memory of 4512	2416	msedge.exe	111
PID 2416 wrote to memory of 3284	2416	msedge.exe	112
PID 2416 wrote to memory of 3756	2416	msedge.exe	113
PID 2416 wrote to memory of 3724	2416	msedge.exe	114
PID 2416 wrote to memory of 3724	2416	msedge.exe	114
PID 2416 wrote to memory of 1856	2416	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m0-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m0-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2e0,0x300,0x7ffbd0dec188,0x7ffbd0dec194,0x7ffbd0dec1a0
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,11429977894837470726,15272584378611409578,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
    3⤵
    - System Time Discovery
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,1241545396476399945,18396634443336785235,262144 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:2
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,3332219615108969613,1656363801677274552,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,4022003544243497276,11468166277118486048,2097152 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,10637687550210343273,10951227163956776216,2097152 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,18154368877786410529,10071041017347627166,2097152 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,4595388231396435598,10776009362410730,2097152 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,6388492681720687615,2354508124320623749,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,3031226955162863099,6039130570964401110,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,12544752641455976782,3747448191327715807,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,4153344500442340652,7851740310849425464,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,4153344500442340652,7851740310849425464,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,12280234166890781647,7744321231090412939,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,5297336098198517881,11118107813327159029,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,16648204195888721542,18302163576846789240,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,11162640447029041164,13670802719083005728,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,10680599079398277936,3418194355469088029,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,14723460973587724780,4534461603428310918,524288 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:14
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6064,i,11995470614824622447,1898169589092512996,262144 --field-trial-handle=2660,i,12926721874796265036,14433719153352328020,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 eef1cfab949da03779eeecd853b998df5bde57cdd4c5827ddef6688f669614da
MD5 dfb1c2a12ad38703ec61d9dae25d4287
SHA1 9a053ff4976d8b759268716d02c457d5c8f1e678
SHA512 3e30c2f928f02b7b68d993dbd059804feaaccf5d036b14fa7df33306d1af36dcf2d4140f77a4f951a6dbeb206ad5b4a3290e9f3d96996a659e6d84e2741f2b53
TLSH
T1C1512C5CA37605DAE32047B2BCE384553FF58CAB09035E172080AE7859C6F075EC2E97
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b0e88b78803e2fa1a6aa566d01470c2fb96ab20779d6e38c688f78470ff25cca
MD5 807cb9115c70221490a0f101dfbf6124
SHA1 a4a55e76cb80b6ce2797a38182dfb80609f11b29
SHA512 8bba54a7dabe2792f5eb6409114fb3ee3970a8ffe909c05b961f15a406dd5df2b96a0bffb9e50442813f1d371c65a0d1b9c273ed6bcd72df3372a259b470dd93
TLSH
T17C41C0F783F4856EC90196F0AA146E1FCE2C0511432C7C5AC9E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4543dde1d374ee7ccf84ea6e1763dbe6b9f4c900ecb73d9c317b488d388be848
MD5 0d4eaabbec9ef43e46f32daf37a57dde
SHA1 428729eeda9b3ba945d397a64f0ff1f543f22c64
SHA512 bf7913c942774ecf718dc9e201609c9381dcbbf32f45c1d2c881a97ea5d031215d70d1c2f5c786ed0a82d25906cb2eb42635a795ea543c7019e417d515529555
SSDEEP 192:sxRXRFCu/fwsbPWZ/LMzoA8p4J/g6+WNIYn8UO7cGxIgV5J:sxRXau/fwsbPg5M/5ITrVd
TLSH
T16942B7156E28A93B9CC7E21DFB15BF53D6F96032A1D41E48BAFC961C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d086970c19bc972d64ca5613adea5e0a4645c6b279d4ccc9d384601e1466a96
MD5 059364a6893b632050f5c1195d8da217
SHA1 a6dd690592c56a1eed05a29db8baa6a985faf224
SHA512 1dace4e330384055cd1823d043e557686637272ddd18459b2645aad5f3da15a253fe8a5bfd2a1fa464a9a394a9e65bd9dc0bba97633627762c4425d8833bdab3
SSDEEP 192:sxRYRFCu/fwstIWZ/LMzoA8p4J/g6+WNIYn8i07cGxIgDz5J:sxRYau/fwstIg5M/5ITVVT
TLSH
T13942C855AD28A9379CCBE21DFB15BF53E6F96032A1D01E48BAFC961C04E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 559e3e2438adb32a89d546f2c8f03df188678a2e0da250c60fff1dcd3fdd8ef7
MD5 55e6324626ad0f96f0b55e177778fcf7
SHA1 465f9bccfd59f1412c535c94c428b644c81b9e7f
SHA512 a443a0591efa4b362a0eecd8e3a6d44e6c8fa4e3542c4d375b10d0bf43ef8ecef2888e9323d212579feac80ec00541e70d3222e7ec2db899b747d44e670e5ae8
SSDEEP 192:sxRYRFCu/fwstPWZ/LMzoA8p4J/g6+WNIYn8UO7cGxIgDZ5J:sxRYau/fwstPg5M/5ITrV1
TLSH
T12B42B7156A28A93B9CC7E21DFB15BF53D6F96032A1D41E48BAFC961C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5ef80e49e8a1f00af676cea5770c4a5badc5ab4e4af439d6ae5c7b939d144e07
MD5 c4337bb4c81e477062c3e3100ddbeb3d
SHA1 00fd187b417e125d6c45c9643d8aa9cd5d7600c1
SHA512 710061cd4076804c3f9c8f4d1fa328d1503861bfa15cb18721a9b7f531c614e810a554adda6cb6f01478595221e43966328d2a0e633229c2650eafe8a6a461b3
SSDEEP 768:wb8dUg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWJRu460rohs+5u:wb8dUsE7r6Wgouf6Mu1jaNJRV6ffE
TLSH
T111D2DA7B640DCA7E4F800ADDEC19BE9F6DA802CB96D8C94447FE941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7cda8f0422d4a39aa4bb7baa39ac9adb872930170017cf33a08e857064400ddb
MD5 09ed906d54ad3d60ccba3b1ebd60b0c2
SHA1 129bc6850654be6de6528adb8c48ce44ff44a49a
SHA512 dbb4d704b48832de9a89185339fe381eaa071d943baf3a4d58a90916331b617a6adfea18f026db27384d2196b94bdf8d9a8b3b3b1afb0561d691554d361dcb09
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHCHuC0UECWMZxgyCK4ngoCcSaBggj+KIUh:CoZs4q26neDsgU1gC/wgziItHCHuC0Um
TLSH
T120911840747B02443C7E7A5C85B8996AB1A274A3315CBCBB375851A28FABF024DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 550bf97a6799590c6501b6ef449971aa4356b4c478f573ef1b1d3ce111129cb1
MD5 af63bc4aa158ea9b7b9822156cf6abbc
SHA1 b2b94ce53c414f81a5b42c64f7a5999bafa5a173
SHA512 2e89eea6a00ed60fc0995fca34053e300262faaef2f643ff7cf3d083c01bca35ca8a29e4a9a5f2baa62d3d9cb8d5981ff3f7e01e1dbc1b9c42148913a5789a8f
SSDEEP 384:nuZcIL38NUgzlcgBkGJDZNfNoXOVSUUWaI/AJEETRzcoXfK86sfxEZxxsIj4lBcT:ML36RBvDZIO0nBJTNzc4ReyIsPcPi9Po
TLSH
T16AF2BF71AC658D63ACFDA646F6523652BEF42177C1C81A88DAEDDB0C094329D074B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f47723acae19289eedc35aa470709180594c41a2c16643486d7fe52b9ace384a
MD5 1a9677e7ba5fbd5ec948c1a67a27547a
SHA1 a29ae913d1fb2fbddc6efc4cabef258a14f89c77
SHA512 020d1e8edc4c5deeda7f5c433ef983d6b4976efac6656cc146d25617280efdbccb1458bf981a792f3f8db5df71701a9bc0cdfe10c68ed151022d75e1f410c1c1
SSDEEP 768:eFQK3PwgKRBuZw5O0nBJUNzc4ReyIsPcPi9Po:1K3EBJUtc44bsUPb
TLSH
T1E7038E76EC65C96BBCFAA786F7157A42AEF02167C1DC69C4DAD99E0C04831DD070BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6fe19267bf65449eb04f856d3ed9a64251477118df0e71a4e277593be14166d7
MD5 79ebc7ba0a525a63ea633b18866263d0
SHA1 51235a0b0b9b71087a7be04381d203d288fe587a
SHA512 16e97bcfbcc1ffcd987e3a0fd921398e52b7c7ee139267d2b14262872e9e55680dacc2323b3058ddcb444ee656093dc9ecf715cf7c2030db130e2125b472de8f
SSDEEP 768:Rrv+4UNbds3acFDZIO0nBJ/Nzc4ReyIs2ceVH1S5D:RbsbS38BJ/tc44bsjEH1Y
TLSH
T10003CF32A868CD33ACFAA646F5477A533EF4216B81880F94D9D99F4C494B1DD170F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6a288be449aa9cbd7cb9e6aaa93af3a5847bb58abb736a3b57e9e3cdd1bd084c
MD5 8f3867ae2a02b224b7284005709792b9
SHA1 3afb3f939f20a75dc2380ed6168e27cbfc325da8
SHA512 e1da61393e28a2eb47a76d1d82d8d661568d79d8958a0b976a9d89d491eb3732933a83fdcade6e2cdc3b4d467829a08453e9fad81160388ee83957a3621cba1c
SSDEEP 384:nNZcIL38NU1zlwgrkGJDZNfNoXOVSUUWaI/AJEETRzcoXfK86sfxEZxxsIj4lBcT:VL3XtrvDZIO0nBJTNzc4ReyIsPcPi9Po
TLSH
T190F2BF71AC658D67BCFDA746F6563A527EF42177C1C81A88DAED9B0C094329D070F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2a96af5829d21ba35ca8094cfa374fea75eb402fd15789c6027f7054ef922e12
MD5 3a977852fe85ad89a044301ebd64e93e
SHA1 4ee97e4a2b12eb6a59603d92ebf43290ae1ee87f
SHA512 a6a4de5bf5203c0ddbe5a19470ef297e047f30e6dbbccf860627b92d1f8fa38f4086e2dcea7266b866441fd942779ac6c7050418f2a3618c0af9de701fa997e0
SSDEEP 768:6rv+4UNbds3DfDZIO0bNzc4ReyIsXxeVH1S5D:6bsbS3ktc44bsBEH1Y
TLSH
T17D03CF32A8788937ACF6A686B54775137EF8612B82C81BD0C5DE6F4C4A4B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2416_1999830615\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download