d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v11K-m5-eL.svg
Size 28KB
Sample260817-msvp6ayblb
SHA256 d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d
MD5 f2f7df101c9bf5d75ce49d42491e9f8c
SHA1 bfa147420c27f8f75982ba6d99be1b938f30cd3c
SHA512 85aa10c95f787a0460395f4aaaa5184eefa4b66ebfd48e0931d021752560f69fee8e79a0788d026d5c00ca8258cc558db5121631ce5c6bd0df1410ceb6c76dba
SSDEEP 384:ckwQGRNPUTQLwwizqwaowD66Uu9dqbvCK+E9xrYTxkk4sQsDI:c5QGvji
TLSH
T125D24D6437F83C9B8BCC03478D52EC68465FA8B7C498678D97C7D4E8A988368F76C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314370726726779"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{014AD61E-1988-4A65-97F9-E454BF0D984E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
260	msedge.exe
260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4836	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4836	4204	iexplore.exe	89
PID 4836 wrote to memory of 4068	4836	msedge.exe	90
PID 4836 wrote to memory of 4608	4836	msedge.exe	91
PID 4836 wrote to memory of 4668	4836	msedge.exe	92
PID 4836 wrote to memory of 4608	4836	msedge.exe	91
PID 4836 wrote to memory of 4608	4836	msedge.exe	91
PID 4836 wrote to memory of 4976	4836	msedge.exe	93
PID 4836 wrote to memory of 4976	4836	msedge.exe	93
PID 4836 wrote to memory of 760	4836	msedge.exe	96
PID 4836 wrote to memory of 760	4836	msedge.exe	96
PID 4836 wrote to memory of 760	4836	msedge.exe	96
PID 4836 wrote to memory of 4828	4836	msedge.exe	95
PID 4836 wrote to memory of 4828	4836	msedge.exe	95
PID 4836 wrote to memory of 4828	4836	msedge.exe	95
PID 4836 wrote to memory of 1576	4836	msedge.exe	97
PID 4836 wrote to memory of 3300	4836	msedge.exe	98
PID 4836 wrote to memory of 1576	4836	msedge.exe	97
PID 4836 wrote to memory of 1576	4836	msedge.exe	97
PID 4836 wrote to memory of 3300	4836	msedge.exe	98
PID 4836 wrote to memory of 3300	4836	msedge.exe	98
PID 4836 wrote to memory of 2856	4836	msedge.exe	99
PID 4836 wrote to memory of 2856	4836	msedge.exe	99
PID 4836 wrote to memory of 6048	4836	msedge.exe	102
PID 4836 wrote to memory of 3172	4836	msedge.exe	101
PID 4836 wrote to memory of 6048	4836	msedge.exe	102
PID 4836 wrote to memory of 3172	4836	msedge.exe	101
PID 4836 wrote to memory of 2712	4836	msedge.exe	104
PID 4836 wrote to memory of 4628	4836	msedge.exe	105
PID 4836 wrote to memory of 4628	4836	msedge.exe	105
PID 4836 wrote to memory of 5356	4836	msedge.exe	108
PID 4836 wrote to memory of 5356	4836	msedge.exe	108
PID 4836 wrote to memory of 2368	4836	msedge.exe	110
PID 4836 wrote to memory of 3432	4836	msedge.exe	111
PID 4836 wrote to memory of 5228	4836	msedge.exe	112
PID 4836 wrote to memory of 4260	4836	msedge.exe	113
PID 4836 wrote to memory of 4260	4836	msedge.exe	113
PID 4836 wrote to memory of 4372	4836	msedge.exe	117
PID 4836 wrote to memory of 4372	4836	msedge.exe	117
PID 4836 wrote to memory of 260	4836	msedge.exe	118

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v11K-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v11K-m5-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8b7a6c188,0x7ff8b7a6c194,0x7ff8b7a6c1a0
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,10604312510856433610,14235214281335620698,262144 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,618947069671076268,18391748449671618750,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,6104382864315659210,3719550573949568112,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,14081844415251350731,12226107558881962509,2097152 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3700,i,4539843346997124982,15107819563633446479,2097152 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,17523836941580466528,11704939389548427750,2097152 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,12356018569163554470,15666162784868589154,2097152 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,17777256530081386434,11191936020076468720,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:14
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,4102427105189760260,16222469970009170365,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,12230662330646155577,9478204802414177539,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,14884910782026492304,5251625762407053330,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,14884910782026492304,5251625762407053330,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,10852136072926609402,1932371936099621148,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,7471814288412919274,10959166322736211229,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,7021661352745905384,8280698838088870766,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,817111528186512658,16758711275128748605,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4019711207103535265,6205085752365905362,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,5920085820900872810,3313099359933486438,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1598070090175959855,337550700553008432,524288 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6832,i,11501670213605338108,9625725905739478907,262144 --field-trial-handle=2340,i,621657377921821255,293392112668440907,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

2260eb91-33ee-4552-9d9a-09d6a61cfc7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2260eb91-33ee-4552-9d9a-09d6a61cfc7c.tmp
Size 11KB
SHA256 8d9b4f970bac00759099f4e76f939bcb26dc193bbd1f3f0de0551058219e25cb
MD5 0e482c58f01910b9df7424f9cf517d97
SHA1 fc1d37229ba86fa793063d2fba91af5cd94eac50
SHA512 22062fcf9908959a6ab28831caf31b8226372bbcf7ae47c6fac3929a21b508246fe94168b05c09a9da8b1907030f97a5118547c90aa3e315b200ab4df0ad7c4e
SSDEEP 192:sxRARACu/fD1s1eVZqZzoA8p4N/g6+WNIYo5KCYEG0IgDAmJ:sxRAtu/fD1s1ebFI/5IzDD
TLSH
T10242B8156D28A97B5CC7E21DFB65BF53D7F9113261A02E48AAFC861C04E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ee5377f5d0de8988ced03e08ed76e3a424afbb1264e123d7cdda13e47c244a5e
MD5 298a35a8303947cc1ea65f89b3cd5216
SHA1 50b1e85868cfaa56841320e46512550c36827a5f
SHA512 3a28e716ca799246ea88d49226d0b66475eb2f588a6e2aa2f2aa8f9d3b10b155dc5eb615a214c16b1d4e577c41e9cbeac0f0f0762c3550313ede9a4067b8f638
TLSH
T13C5150612B2D29E3D7B641B370E5195A36FFD40942AF2E20A0D45D745E22F0FACE3867
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b0c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b0c8.TMP
Size 2KB
SHA256 965c852a01eae37bf806d88b03702fa69f3da9dd8e66bc39418a71e562d9bb52
MD5 15a76d3a6c547d7f55e0f0cab74b36b5
SHA1 098b4ea9b9bc58e6ad1d85c3cc971daa091d9ff8
SHA512 287e80cecfb0099692492c42560e37bc29e8e0b27c8c12448a73ec8be4b31b6b1305ba30b74e0b27cd9f8eb6d5848d58bcac700622f8f315c862fd20bdb2d5ad
TLSH
T1355161612B2D29E3D7B640B3B0E5195A36FFD44942AF1E20A0D45D745E22F0FACE3867
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1d37101de168fdd0f882f1dcaf82d983d6e772918335044c16426dd283027e49
MD5 6bbe0b3a9e096713dcebb1cba78677fe
SHA1 5307bf822ce9ce85ed2aa9f2d8d25340c1837fca
SHA512 f3bd91eb6415982b02f8ab1670e3e467be04f51abdcfa953d2f676df2d705d4667ee6bb954eb5b5e4d6d04570aa4d1c33a52d403a969af981fb375fcd31da3e5
TLSH
T138418EF783F4856E890156F0AA146E2FCF1D0525432C7D5AC9E4AE2BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 304b4b8bb29aaf4d93d67e050a15cd2f12529123cff14434ca75553e75870341
MD5 b07730f217ec2f395395df3a14c9005d
SHA1 49b32606aa98e5b2ed1822b73d41781e5bba40bc
SHA512 22ca796ad6fac4cbee783484fd155b9506f2dbd906a6a9b82578f95a03c2bfc552d73fa6f66d6c1551da50dc629b8a022d3ca2144620ab9ae3351b9d0aabdc3d
SSDEEP 192:sxRLRACu/fD1s3eVZqZzoA8p4N/g6+WNIYo5KCYEG0IgVmJ:sxRLtu/fD1s3ebFI/5IzD4
TLSH
T12232B7156E28A97B5CC7E21DBB65BF53D7F9113261A02E48EAFC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e652ce9b4d92e439539eefc8ed1be38775adb96f41b61fc0259d5524c208cbfa
MD5 a387fb49f61c8107eabb9625959c5531
SHA1 e8e1b524e0dd13ca3ed4817a5f4a508fa5bd82fb
SHA512 d2efc095e4397dc9c3ec44f3dd337f3e735dc30a924ae6add49c468907a6500b67ba029b7dccd60f909c36d496cddcbeaec77b5b44cdf7cb6eca2eb7f53f2fd9
SSDEEP 192:sxRARACu/fD1s1sVZqZzoA8p4N/g6+WNIYoccCYEG0IgDSmJ:sxRAtu/fD1s1sbFI/5IODF
TLSH
T1CF42C8156D28A97B9CC7E21DBB65BF53D3F9513261A01E48ABFC861C04E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a05da0d870c67f9b8c800b97436b352a28f443811cd10574cd18dae5017478c7
MD5 98095a2a02c1cff5b7bbf73f5f93446a
SHA1 dd15e3835919f9091a97eb0a7f076900a6ef4786
SHA512 39b9d9f7642167a73b341aaf542efb56b3021c0ecbff2f8715e3ccd14ad380336a8d991ccd32e093bfc25decc8534d52c0b2262344ecb43c7e9135cff1eda4ff
SSDEEP 768:j26H/o7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVfkBVuwgro9i5mU:j26H/UE7MRWgs2f02u1ja8kB4wrA5X9
TLSH
T134D2DB7B740DCABF4F800ADDDD297E9E6D6802CB9698CD8047FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf2061e0-5d5e-4b94-a97c-60e746eff243.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cf2061e0-5d5e-4b94-a97c-60e746eff243.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 341d04500ba467a22013fb0154dc20d76cb0ccb57c8a96aec6d8b19c2bc19610
MD5 b4f85fec7b493bc6127aa1038bc81160
SHA1 5f2f0b728225709193eaba240cd91d5ad118eb53
SHA512 fb9e516b4069d7d37a278bdb2bbf700abed257e5de000035239b99eea2431bbd05623f254454fcb8b0055a9d8624893db949f8670aa03adc0d74e0c9feed9d2b
SSDEEP 768:1rv+4UNbdz3wZY/TBOWT1a5lONXyer1IRCzniwjeVH1SK7:1bsbV3wqj6lSIqn3EH1l
TLSH
T1C403BF31A1A9DE335CE6A3D6B08772877FB8206BC9800B90EDDA1F4E059758D230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 78985532124239eef8b00b81fbcb716ef7cd4c27963c61b7d465c982b2f6b0a2
MD5 8dbbf1d691a939ecf24e92508a2b27e3
SHA1 d8b5c6b99802995670111405fc58397429484331
SHA512 e4b9bbdbea63c4bc68244f6d933d161ccb2193834f7e2e01c7ce94137943665168697432dd56645aad975bd9e9ac869d6dffe8decd51f9f25d7d80b9ea62610c
SSDEEP 768:EFQz3wwgyVNVsOWT1a5uONXyer1IRCzni9jPi9PXx:nz3Tn+6uSIqnIPy
TLSH
T1ED039D75E894DE27ACE6A7C6B74A7787AFF81063C5C889D4EAC95E4D00C719E030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7a17a3853ce2fbbf95e2484e21352271a2b831725e0018bf935f0567bdec4dd9
MD5 6c3a9e3b9afaaf3fe31e4ed61fe92299
SHA1 d472c2ac727337c679d716bd5f10dfa8bb63f406
SHA512 ad798f3db3e17625b55f17b911cf7cbbe59dcb6e19aaac9d4a1e2ba9cf9d8627137441f71afa5f833b860a504572f9d38642084d0400b2792ebbe2168a8e1f79
SSDEEP 768:643z3O/TBOWT1a5nONXyer1IRCzni9jPi9PXx:643zej6nSIqnIPy
TLSH
T12AF2BE70E5A5DE235CE6E3C6B68A2387AFF82077D5C00A94E9DD9B0E058755E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d529ef28826e52976278e96a04edfa8167b84b81eb5e095cbd6c9057e7a454c8
MD5 3cef58b4fccd019e181cedd065015a48
SHA1 7d8ba7395c572e78d31be043d56a4b07cc116a02
SHA512 001451658bdd31528cff9b6601d2c0857d9a9843e75c8f8fe69895c01267ad7467bcd6a0cf97434772e716e88f1e5c3e600fea6afb66b915fab44fa007574463
SSDEEP 768:hrv+4UNbdz3tt/TBOWT1jONXyer1IRCzniBSeVH1SK7:hbsbV3vjjSIqnFEH1l
TLSH
T1E803CF36A4A8DE338CE2A3C6B04772477FB86057C6840790DDDE2F4E06AB59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 156c78d112fc0eb59628644d638113f24ff2d2a1907d2de749552c2fed8c4743
MD5 eb0f56030ec28032154d6eb5434affed
SHA1 c99b500728e6bc3038fe3169da7264b330b30d4a
SHA512 91d1bc654c10637cfd8a5a23f51f619ce84716fc57875b9cf21b387e2c8ba767d120dd9e9a71fa01e179bb8ef59355909824e97253667832addc5d57443008c2
SSDEEP 768:M431VO/TBOWT1a5lONXyer1IRCzni9jPi9PXx:M431kj6lSIqnIPy
TLSH
T15FF2BE70E565EE235CE6E3C6B68A2387AFF82077D5C40A94E9DD9F0E048755E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d93d3ae8-1464-4eb5-950d-87f66c6fd8ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d93d3ae8-1464-4eb5-950d-87f66c6fd8ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4836_1362089500\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download