d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v10J-m4-eM.svg
Size 24KB
Sample260816-e9efhaz1bz
SHA256 d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc
MD5 8c786d4da80ac1948a137a727a12fd7e
SHA1 0fb0844fb479811339f7104eb281a91b930ca91d
SHA512 838d9d0ec608d1e47dd3722b8ccd401e03eb334982cd433a7f896e66b62a9e69b9d2d3e8209914dd8563af8734ee368742a979b7e861efd480707c961c193a0e
SSDEEP 384:c5veJtU7WSADG+2tM8LSB7XXZwuw5wE1/7PRP3uDCr:c5vQjqZmDK
TLSH
T11FB21F6437F87C978BD803479D02FC68461FA877C4A8678D93D7D4E8A988368FB6C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313286975547708"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{4B8961EA-EA0E-4B11-86A4-119D291E9867}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
200	msedge.exe
200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4840	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4840	4544	iexplore.exe	89
PID 4840 wrote to memory of 4684	4840	msedge.exe	90
PID 4840 wrote to memory of 784	4840	msedge.exe	92
PID 4840 wrote to memory of 4976	4840	msedge.exe	93
PID 4840 wrote to memory of 784	4840	msedge.exe	92
PID 4840 wrote to memory of 784	4840	msedge.exe	92
PID 4840 wrote to memory of 3400	4840	msedge.exe	94
PID 4840 wrote to memory of 3400	4840	msedge.exe	94
PID 4840 wrote to memory of 244	4840	msedge.exe	95
PID 4840 wrote to memory of 244	4840	msedge.exe	95
PID 4840 wrote to memory of 244	4840	msedge.exe	95
PID 4840 wrote to memory of 256	4840	msedge.exe	96
PID 4840 wrote to memory of 256	4840	msedge.exe	96
PID 4840 wrote to memory of 256	4840	msedge.exe	96
PID 4840 wrote to memory of 2928	4840	msedge.exe	97
PID 4840 wrote to memory of 2928	4840	msedge.exe	97
PID 4840 wrote to memory of 2928	4840	msedge.exe	97
PID 4840 wrote to memory of 1120	4840	msedge.exe	98
PID 4840 wrote to memory of 1120	4840	msedge.exe	98
PID 4840 wrote to memory of 1120	4840	msedge.exe	98
PID 4840 wrote to memory of 1724	4840	msedge.exe	99
PID 4840 wrote to memory of 1724	4840	msedge.exe	99
PID 4840 wrote to memory of 1004	4840	msedge.exe	101
PID 4840 wrote to memory of 2588	4840	msedge.exe	102
PID 4840 wrote to memory of 1004	4840	msedge.exe	101
PID 4840 wrote to memory of 2588	4840	msedge.exe	102
PID 4840 wrote to memory of 5780	4840	msedge.exe	104
PID 4840 wrote to memory of 1072	4840	msedge.exe	105
PID 4840 wrote to memory of 1072	4840	msedge.exe	105
PID 4840 wrote to memory of 5900	4840	msedge.exe	108
PID 4840 wrote to memory of 5900	4840	msedge.exe	108
PID 4840 wrote to memory of 5388	4840	msedge.exe	110
PID 4840 wrote to memory of 3700	4840	msedge.exe	111
PID 4840 wrote to memory of 2860	4840	msedge.exe	112
PID 4840 wrote to memory of 5800	4840	msedge.exe	113
PID 4840 wrote to memory of 5800	4840	msedge.exe	113
PID 4840 wrote to memory of 1104	4840	msedge.exe	117
PID 4840 wrote to memory of 1104	4840	msedge.exe	117
PID 4840 wrote to memory of 200	4840	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v10J-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v10J-m4-eM.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd15d3c188,0x7ffd15d3c194,0x7ffd15d3c1a0
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10153669013838325387,16536546305779993082,262144 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8448117539921760284,14999537187936421613,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,16711325438015930207,10420041291671558342,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,16772452516319536291,1446491954209395238,2097152 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,15090467834137282771,10920903347506767825,2097152 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,14725165076337408101,17722853619146310068,2097152 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,14740942888597807754,2280023135626331777,2097152 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,2800307082217861166,1635190384747399767,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2105736106880113431,9232224682715163665,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,11211858765937130435,15595349480174957673,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9079177364426293898,3066735636052787040,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9079177364426293898,3066735636052787040,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17072009237509115020,8721786760978451668,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,10106558793529712165,15847950412842134711,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,3025643382138429232,8937720065044963255,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,3108690378575374711,9661257198145839705,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,13902543640147894367,1492478946380186971,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,17859504223176915862,14690390480939791858,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,6558460013013930869,193536632268411050,524288 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6028,i,4262476598555267202,9818450102212424839,262144 --field-trial-handle=2764,i,18411503102352033685,12743432468535191117,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c0522f65fdbcfdab4e5cfb03f5bbcf2da8120e27d07cb6cf801cb28124132884
MD5 ca745f23e4db329775b55948abcdf32d
SHA1 ecadba80bfc3bee141470d1b3b7b03d574bd7861
SHA512 c41d5dceb8bde8aa19d05ac340d808aa85fc7fe5c1cafac2aee45a521475aafb91e0981a4b2fd3fced633b97157e36e16484485067fcc41ac74b394e31503b1c
TLSH
T1AC51830B93569EDFCB66C87352D2A45836F7B0B189033E0065FB6E78C802F8062D152F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598766.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598766.TMP
Size 3KB
SHA256 4658dd470550b30d20348d01b966e4d06598cc4253119cc80aae5479574f5548
MD5 73e32ac53bb3d6e45d0bfa052c64428c
SHA1 d1dbed912474ec56ff1a626141bbfa653f7dbb3b
SHA512 194db83b7dbf73aa039be75bd69b6aa7e3afd3738c3b92385601e89c3b10901f75518a4716abaa0d47c28ff081e1099db1342ae3d34e1ff180da6709eda36066
TLSH
T10C51830B93569EDFCB26C87352D1A45836F7B07189032E0065FB6E78C802F8062D152F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e9127e86f9c0e68c9830f3da80506b03f9dbc386b826ad179166039e65ddc205
MD5 f275d0a6d1c9f0281b44c764c72cfe3e
SHA1 ec037855029bbd7004e688164eab39ab3f5e109a
SHA512 c7621228e45e8c660dd53b7cba43969c35cb0c47ac3e7067d8fe645fa78647bd67f236cc76632e1585d98d95b896543e5fe51a4c2a346376401bb350d6a5291c
TLSH
T11C41AFF3C3F8857ECA1196F0AB146E2BCE2D0525432C7D5A89E0AE2B93E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eb048a26a8f488f33e07e0a74ad38fe18b95a0ad7fb3c79697587974e53283e8
MD5 a37baa7765ba6b9ddefa29e4cfbd928a
SHA1 4ced9aded416ef920aba912e68e8172b3c97a936
SHA512 513fed0f82ee4d3bb4f976cbe38ed84aa73bdcce77fd979730131dcc8ea32fde80d66c2d8210106ab673c3951d16cb1aa5e4aba355157200e122bb16e7f665ec
SSDEEP 192:sxRKRCCG/fksqA2b5YZ/4fyzoA8p4P/g6+WNIYZFLKx0GkIgVzJ:sxRKDG/fksqA2b5mQf/W/5IS3H
TLSH
T13032B7156D28A93B5CCBE21DBB15BF53D6FD2032A1901A58EAFC8A1C04EB6DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 45de66b0411847cec879afbd0f187d08a43bf39616a135845106ddbc1c6a12cf
MD5 fc2f692ea6e514815fc7a2c60500bae6
SHA1 b152b0f9b81591bfd4d741b1b453e10f2300ddb0
SHA512 f92c4c7025cbaeb1cd1e2d3253ae205846a6665234fdba3578e5b2343606b3bba6c7fef0649643b675055f30d13093d72a66dd90956b7aec65314958880d5bf6
SSDEEP 192:sxR5RCCG/fkshA2byYZ/4fyzoA8p4P/g6+WNIYZFLFp0GkIgDpzJ:sxR5DG/fkshA2bymQf/W/5ISYX
TLSH
T14A42C815AD28A93B9CCBE21DFB557F53D6FD6032A1901E48EAFC8A1C04E76DD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4fb66a8e2ccbcd0ec48da19096e171f6ac333ff95a97ea14490a6ff5fb345e41
MD5 1c0247fca3d13da40d76c0939cca0672
SHA1 18c350edfd7d2ed3bd32be3d3f8b06717b1491b7
SHA512 8e59043751a8ea29b6aa28088ecada4db81748ce72926228c0873ca9f1ada2ea51e005c7ca9deb0d6dd75bff5e2225cb90392bf9a0d2284dc7f9757c7b87db3d
SSDEEP 192:sxR5RCCG/fkshA2b5YZ/4fyzoA8p4P/g6+WNIYZFLKx0GkIgDbzJ:sxR5DG/fkshA2b5mQf/W/5IS3l
TLSH
T11442B715A928A93B5CCBE21DFB55BF53D6FD2032A1901E48AAFC8A1C04E76DD121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d36bcde3b3e380685852a17856c0567a2d86146a2e728ae2036f0a35bb106303
MD5 6c36cfe7907d4152d29cd34753f18ff9
SHA1 115a4f4cad77a935fa80ee2454cd6d89903f1c97
SHA512 006c6d69465467feb0aea855c4cf7433d6a73d72db196b36b78d92751461b228e9d7b8acf40e2b8de83047effb7d6fdc2dfa85460e5c345f21c626e2ec41b388
SSDEEP 768:K80EY67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVh9owLWyroLc47:K80EYSE7FwWgNhfVNu1jaG9ogWpLc47
TLSH
T12AD2D97B740DCB7E4F800ADDAD197E9E7DA802CB9698C94047FE845C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6760a274ec7738f9aebccd47064f8a6e4a5e3957af37ea7e7d50994dedcfa4f1
MD5 507c780da879beaf712055f548a03f76
SHA1 5c9b1ced4b77c115e256c62e61380989ff1f0d5b
SHA512 843df1d4b8f5648eee82fc3fe1db99d6a9108a207906fe4fbd7ca7a77f4cdbb12bdbfc9c82ce23a63affa7a98e48973685df6ed123da234d86efe59087a518fa
SSDEEP 768:Nrv+4UNbdH3X0+LeSFOUxGaX4fouOToPvB2thtA9VABVeVH1SlX:Nbsbh3XsnnwthttnEH1Y
TLSH
T1B703BF7294AC8933DDE6E398720BB2937FF4516395C00F849AD95B4D0647A9E070FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e1dfb5a9418aebdd15a4a52a3538028a1cccc02fed87f1fc6dd55fd1c47220f8
MD5 3b94eab8cdf89bd91cdd5c23d17389ae
SHA1 1b2d742241e3e7b0759fd340b80cf7f0d0fc098f
SHA512 cf45af18d23b0aa900bdca2b4ed814edac556ebb6e86f1b8da16149f2c80da2564762fb69c6a2752a28d69de65afa3f9ce671a0fc38858f0f14151fe3f5a8b55
SSDEEP 768:grv+4UNbdH3GM+LeSFOUxmX4fouOToPvB2thtA9VAwLAeVH1SlX:gbsbh3VsnnwthttMAEH1Y
TLSH
T18403CF32A8A88933DDE6D398720B72572FF4915396D00FC499DD1B4D069B9DE470BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9d1247aa074a888e73b42acbe0d40fb71b97a4ae9e5a5f1ecacdb9831e28085f
MD5 edf6c0b7d8aba5b0adaa639bfc0ca52d
SHA1 e5bf2e7e7c8d43ee8dbc2c0b63f817881ed3726d
SHA512 4bfa1d2f2b5ac83ef8e347ccdbfa842aad335a7d0023f49cc8b3b08036f62cf9351cb9ffff1fe7a3fbe0f0e762e14119d95400ce3672c66ceb4a1e4987339e64
SSDEEP 768:ZW3DtyG+LeSFOUxGBX4fouOToPvB2thtA9VAgVPi9PkI:ZW3TsnnwthttcPs
TLSH
T18CF2B0B198A89D23DCE6E398720A33936FF45173B5D01F889AED971D058369E0B1BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3271e00183c800bf423171d5a1db12d64d1e45018a67cbb8ed71167e6d9ded15
MD5 7695e6fb13d2314a070e6cea798e36b5
SHA1 d0b6d556aaae767aed621623103235c4b4be2163
SHA512 bd3aba79d25fc57741df682f0e21856dbdde802ee9265b3025de4e749bf0cdb0a999118c8ee1fe49fc9c57bbc638764326ba1ac5dcc734c1b87a5377c379ff99
SSDEEP 768:zW3at4G+LeSFOUxGUX4fouOToPvB2thtA9VAgVPi9PkI:zW3fsnnwthttcPs
TLSH
T1D0F2B0B1A8A89D13DCE5E398730A33936FF45163B5C01F889AED971D098369E071BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 959213178097742ec312f9d06afd437a45fd1c4b10a1d5064785210cad4f328b
MD5 f6ca850fb301868dd6a2b1b12bf40302
SHA1 d89eef7940cdeedafa9d780c3d3648bf8d7491b4
SHA512 92141513812b2e08e431ba1d3ad8fdfb84be76ee98f92b17af54b7af940adfbe03918f7c7bba9649eaaf6fc23556d8b28c1ac7db3e86bfc72a5ce2b24c4a9b0f
SSDEEP 768:FFQb3cwgtt4nE1OUxGgX4fouOToPvB2thtA9VAgVPi9PkI:kb3ksnnwthttcPs
TLSH
T1EA039EB2D8A8CE27EDE6E7D5B3097286AFF0116395C45ED8DAD95E4C00836DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4840_674755514\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download