61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260816-xa78msgp7s
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3384	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313792833456763"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{379D1EC7-87F3-4C57-932C-E4BE30D5D61A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5360	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5360	5048	iexplore.exe	89
PID 5360 wrote to memory of 1668	5360	msedge.exe	90
PID 5360 wrote to memory of 3384	5360	msedge.exe	91
PID 5360 wrote to memory of 4668	5360	msedge.exe	93
PID 5360 wrote to memory of 4668	5360	msedge.exe	93
PID 5360 wrote to memory of 2644	5360	msedge.exe	92
PID 5360 wrote to memory of 2644	5360	msedge.exe	92
PID 5360 wrote to memory of 2644	5360	msedge.exe	92
PID 5360 wrote to memory of 620	5360	msedge.exe	95
PID 5360 wrote to memory of 620	5360	msedge.exe	95
PID 5360 wrote to memory of 620	5360	msedge.exe	95
PID 5360 wrote to memory of 252	5360	msedge.exe	96
PID 5360 wrote to memory of 252	5360	msedge.exe	96
PID 5360 wrote to memory of 252	5360	msedge.exe	96
PID 5360 wrote to memory of 924	5360	msedge.exe	97
PID 5360 wrote to memory of 924	5360	msedge.exe	97
PID 5360 wrote to memory of 924	5360	msedge.exe	97
PID 5360 wrote to memory of 6100	5360	msedge.exe	98
PID 5360 wrote to memory of 6100	5360	msedge.exe	98
PID 5360 wrote to memory of 6100	5360	msedge.exe	98
PID 5360 wrote to memory of 2000	5360	msedge.exe	99
PID 5360 wrote to memory of 2000	5360	msedge.exe	99
PID 5360 wrote to memory of 3428	5360	msedge.exe	101
PID 5360 wrote to memory of 4636	5360	msedge.exe	102
PID 5360 wrote to memory of 3428	5360	msedge.exe	101
PID 5360 wrote to memory of 4636	5360	msedge.exe	102
PID 5360 wrote to memory of 1664	5360	msedge.exe	104
PID 5360 wrote to memory of 5112	5360	msedge.exe	107
PID 5360 wrote to memory of 5112	5360	msedge.exe	107
PID 5360 wrote to memory of 1836	5360	msedge.exe	108
PID 5360 wrote to memory of 1836	5360	msedge.exe	108
PID 5360 wrote to memory of 4648	5360	msedge.exe	110
PID 5360 wrote to memory of 1984	5360	msedge.exe	111
PID 5360 wrote to memory of 1992	5360	msedge.exe	112
PID 5360 wrote to memory of 3240	5360	msedge.exe	113
PID 5360 wrote to memory of 3240	5360	msedge.exe	113
PID 5360 wrote to memory of 3944	5360	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x354,0x7ffc7313c188,0x7ffc7313c194,0x7ffc7313c1a0
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,12443827992211234376,6603241430326316505,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,13177706267093097102,12553660160177120839,262144 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,17881082159562838018,17760082561363529013,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,13268703190976604317,14569275133809169409,2097152 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,4560467785413538520,7057887736015066140,2097152 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,7002676607244960868,11308971976532135132,2097152 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,5115851550416200767,3698250951540978466,2097152 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,17967091135076517962,11603847544842139278,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,2601754208359489848,9708976484669997948,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,1962355045004578576,16943314600883092692,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,12398629001232092828,10533821155699828618,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,12398629001232092828,10533821155699828618,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,8220714519083403253,8818478765956258259,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,3876256702271277515,10236644077927186158,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,10767140969652523006,13794166956619333744,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,10393920407305131525,15983031309719787524,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,1740328088717217513,2782562921780510613,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,12006381024537377739,6487627946042921340,524288 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=948,i,1720706940235524893,1368856467369108659,262144 --field-trial-handle=2324,i,17729374137506834598,16943968696947441524,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71a9ae43a3707858d74518bf881aa8d023571c3614494ffc34cd61b402e1b66d
MD5 071f8e304bec390f1ecf97b74a1d75da
SHA1 b44295515d877479927f6e8acd42f15cb51b1c6a
SHA512 e62a980d05cebfd856d52eff59e49d4766b45e30a9c473ebe8a9c4168b0ca3ac5e030d001badb4b9eb170f248791b0a11df91639e9e566b5f0df155c6203baef
TLSH
T1F061506383658AF9C725F5B3A0E5949C36FB44713B8B2E32601E8E368456F1C36E9533
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59208e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59208e.TMP
Size 3KB
SHA256 7aaca07f42da0f9c87c6e9cf5254a431d5474e03708d709cd54decabf8b2f079
MD5 dbf66ce220e2d0568795c829fa034800
SHA1 79f6acdb6066aea0289e9c3f67ca765677ddca75
SHA512 ad10ea7c79d20cf900df1e33b729e9a1423c321d1a3da3cf134813cc58c4cf7d991fef51cfdbb1e09ee2b2b6f26318faff5d7d8b201f7d289af0cbf10ce563ef
TLSH
T1BB614F6283648AF9C725F5B3A0E5949C36FB44713B8B1E32601E8D368456F1C36E9533
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5bfe93239ab12302f950f8f0202aa63a61261cb06610c8ed418d88fdf73f9a3d
MD5 5908687fdee2f4f1b273f44541c1188f
SHA1 6f0a78e77aecd6a75b42c752b8f2f28395aab074
SHA512 48abaf2a45948bdb93a4138bc22ace49194ad6137d51ccf918bc878f7cd2509cabe7822db97bb996acb052e1700714a41edace54357e499eea3b9bbe0ea2f7e7
TLSH
T1CF419EF383F4856E8A0196F0AB146E2BCE1C0515432C7D5AC9E4AE2793E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 14bb2117eadd3574326c1ad985bbe6c7c2b13b47e2498ea3f49cdbadf03eb687
MD5 997bd6905bad7998e3681f870ecaa48b
SHA1 21b26e41763b06c07500e4da04484f55bab9b76b
SHA512 446a1d54370076498e17fac931ae8ae1581fdbb0e8ea53579c4413589bf000989e5c45327b06a8f5c25c4c1766d2a29eee9270beaa5116275eda0a8dd35cc2d3
SSDEEP 192:sxROR7CU/f4sX0xgSZP/dBzoA8p4b/g6+WNIYEgh3WG3lIgViJ:sxROEU/f4sX0xg0HSm/5IQjc
TLSH
T14132A8166D28A93B5CC7E21DBB55BF53D7F92032A1941E58FAFC861C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0fc017fcdd9ef04ea9b8b42fbd8cf829ce634d488185d42f7c33bc1746dd8e13
MD5 395cab46d4c839cef1fd894b5a0f9dc9
SHA1 34db5e0dc0a5d92acf7dfe760ca975857de72846
SHA512 c69312d2bb4e1b48ec9ccd496d49320a66c9f1948761085fb33017be262466de1c5d5bc394c5f6d34c8f7155b975bcf28e52119c06b4ba7cc0d4d121561f13f0
SSDEEP 192:sxRpR7CU/f4sq0x6SZP/dBzoA8p4b/g6+WNIYETd3WG3lIgD/iJ:sxRpEU/f4sq0x60HSm/5Ipj6
TLSH
T1B642B816AD28AD3B9CCBE219BB55BF53D7F91032A1941E58EAFC871C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bce594a3a04e5bffcd67aa5e45879ab4c0ff3c9bd8a8e07053cea70fc57b09c5
MD5 53dd34ff1eedcbc49ae6027fd3e12c9b
SHA1 82b865c4efbd929fc6cc55a68cf912ee8d2c62ab
SHA512 18bc1ca89ac56432cd6d25d695b3d4b0c230877e342848abd6c2170a2933e7c4713c479a4d78205513e1559d9ec519077d4de15288ed15b6f15b2cba2288fdfc
SSDEEP 192:sxRpR7CU/f4sq0xgSZP/dBzoA8p4b/g6+WNIYEgh3WG3lIgDliJ:sxRpEU/f4sq0xg0HSm/5IQjg
TLSH
T19542A816AD28A93B5CCBE21DBB55BF53D7F92032A1941E58EAFC871C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7b263738fc7f49301e20cf133b8858396f86c7d5aa2911eef117f010fa4b40cd
MD5 116ed390cbebeb8208d2d84453b6bc26
SHA1 fcbb05f55d5ceaa8553efa922b500aab467cc1db
SHA512 c125b36dd044e12c05d0fc0f304a5bcb3d8401c3a1a7afe3860dc885b9245a93fb755b88c9f8ca3d4909a576377bcc7ed7f50a0ab77cd6268e2b0ecfa87fdd0d
SSDEEP 768:40Dk6DJQD8AF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVS0:40Dk6DJQD8ATE7N0DbWgQ6DjfIQDFu1j
TLSH
T1D2D2DA7B640CCB7F4F804ADDAD197A9E6D6802CB96D8C98047FA891C02C7BEF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59baf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59baf9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ee20204865433fb9e078b8f693cf068a00f7056df9963d8d5588d7c1a92c4954
MD5 4dbc0fc3a08a89f5ab439ced3c36deb6
SHA1 887df1bc86b1ac7693b3470ad4cb0b549d956884
SHA512 5e94de104d44d3d2b0d26834382895879a1e9e231400bf42893c39500baadd098e674798f6e67d74e0a744bcb2f606f6272d24fd48fd2edd5bbe7c8f47310f8d
SSDEEP 768:i53apsDTd+ZhctmvceX6+qTko0u229a4vsTWPi9PYtT:i53+FrvVTVKa43PbtT
TLSH
T1C2F2BF30F8655C734CEBE784B25626879FB82173E6C41B58E9EDE60D054716C1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ccf86c55622420c1bbcf32a43fce6b38d7c1b73e7414ee9c2c4cea4e2791a876
MD5 2ca095d8a5db59edfd0d1cb8304a41e0
SHA1 1b719fe931ccc17f1f7bd7599c9bacced6a4a58d
SHA512 28a3456aa61fd79e23404c1b5047bbf2e30197751b7fc4ffcbdde8a923eccf170166ea0adbfd95ca2305fe10706595f1d4e3d73594b507ce14331eddd3f70ead
SSDEEP 768:prv+4UNbdG31hGDTd+ZhctKeX6+qTko0u229a4vsDpeVH1SdW:pbsbU3fAvVTVKa4QEH1h
TLSH
T1ED03CE32E8648E778CE6D784714B75472FB96163C7C80B84D8ED6B0D069B5AC230BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 61bed90a9e18d2282665a22ae839b8db497c3f6853f514ac4ef7ef5433e7a681
MD5 1c44cf9d88234e2473c04e1c490b94a7
SHA1 60947e51b7ab8f273148fa13d6c6c02a7aa4da9c
SHA512 0a88b1f79932f2565c6af53b5bfa137621edb86782a36f9d94eec7b148c0ac78a441b37090b37d290339a265a7de33255fc3f24ee9c2a9df93015b02522baca5
SSDEEP 768:7rv+4UNbdG3sYSDTd+ZhctmvieX6+qTko0u229a4vsSWeVH1SdW:7bsbU3DFRvVTVKa44EH1h
TLSH
T14203CF32E4698D3389E7E684B14772876FB821B386C40B84D8EDAB4D064B59C270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b5fa912d4fa6ee4e1227812f99321f3de9973856d812ab419367abf2aa027b2b
MD5 9a5c3e0c83d03d5341ab26d735f0f34f
SHA1 f1eca886ab73d7e6e0fb57847903909a49f43637
SHA512 73245be0297d833c35af2d413bd06195e602f26c5e517835e0353612d4e10d83c38fade88ed6dcd10cda758540d1b7e3d5f85a71f4d1ad589af946932950d480
SSDEEP 768:Orv+4UNbdq3axsDTd+Zhctmv+eX6+qTko0u229a4vsTWo1:ObsbA3QF9vVTVKa43o1
TLSH
T1E303BE31F8299C734DA7E284B11B76876FB821B399C40B54DDEDAA4D054B1AC2B0F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 053a90c50f2f0b087311a0f55d4ade1e67dabdec628f3a863011d5eb0efdf4b8
MD5 dd52443d63690c083bb7f1e4ee54dd0a
SHA1 f6a312acd9a1542bbea71a12e10ef6ed287fddf4
SHA512 be3da5b6e84fe83f1ab219a12070c3a466e1aa36b6b737f5fb5112b7518816331968c8e4cea04621828ddf6545446af2494b7db89f574a80acc4bfb33b8d2cfe
SSDEEP 768:O53hpsDTd+ZhctmvceX6+qTko0u229a4vsTWPi9PYtT:O53VFrvVTVKa43PbtT
TLSH
T154F2BF30F8655C734CEBE784B2562687AFB82173E6C81B58E9EDE60D054716C1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a176e9cd530ac1fbb3a4030bdfd1b9308457ccd52df7f1ed6c6e238970118934
MD5 e219aff29f4a52069d5f797fdccc4c59
SHA1 d9ac381b79481235c7bf4a2757c5dfb088a60ce8
SHA512 f97a2fc01c028c7db270bccb4efb2f838fb4e4bddbcf7a444ea85694296fcc3cdc1bd3091a9c36ac7840e2f6390c70a4e5b1170dd4bf55d9cb3343489f70bf6f
SSDEEP 768:KFQA3Kwg6pjnZhctmvkeX6+qTko0u229a4vsTWPi9PYtT:xA3zFjvVTVKa43PbtT
TLSH
T11A039E31E860CD67ACE7EBC5B71676879EF411B3D6C89AD4EADC9D0900871AD070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5360_1148898132\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download