d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v11K-m5-eL.svg
Size 28KB
Sample260817-qqpmxack5w
SHA256 d08d8cefc21783960a89cfffea6755499860559e53b0645ff5d35ecf0ba2497d
MD5 f2f7df101c9bf5d75ce49d42491e9f8c
SHA1 bfa147420c27f8f75982ba6d99be1b938f30cd3c
SHA512 85aa10c95f787a0460395f4aaaa5184eefa4b66ebfd48e0931d021752560f69fee8e79a0788d026d5c00ca8258cc558db5121631ce5c6bd0df1410ceb6c76dba
SSDEEP 384:ckwQGRNPUTQLwwizqwaowD66Uu9dqbvCK+E9xrYTxkk4sQsDI:c5QGvji
TLSH
T125D24D6437F83C9B8BCC03478D52EC68465FA8B7C498678D97C7D4E8A988368F76C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314469001476905"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{8FB13210-796E-47EB-9F7E-D1F794DCDD51}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5260	msedge.exe
5260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1220	2836	iexplore.exe	89
PID 1220 wrote to memory of 5052	1220	msedge.exe	90
PID 1220 wrote to memory of 1860	1220	msedge.exe	92
PID 1220 wrote to memory of 4988	1220	msedge.exe	93
PID 1220 wrote to memory of 1860	1220	msedge.exe	92
PID 1220 wrote to memory of 1860	1220	msedge.exe	92
PID 1220 wrote to memory of 2636	1220	msedge.exe	94
PID 1220 wrote to memory of 2636	1220	msedge.exe	94
PID 1220 wrote to memory of 2568	1220	msedge.exe	95
PID 1220 wrote to memory of 2568	1220	msedge.exe	95
PID 1220 wrote to memory of 5320	1220	msedge.exe	96
PID 1220 wrote to memory of 2568	1220	msedge.exe	95
PID 1220 wrote to memory of 5320	1220	msedge.exe	96
PID 1220 wrote to memory of 5320	1220	msedge.exe	96
PID 1220 wrote to memory of 2772	1220	msedge.exe	97
PID 1220 wrote to memory of 2772	1220	msedge.exe	97
PID 1220 wrote to memory of 2772	1220	msedge.exe	97
PID 1220 wrote to memory of 5260	1220	msedge.exe	98
PID 1220 wrote to memory of 5260	1220	msedge.exe	98
PID 1220 wrote to memory of 5260	1220	msedge.exe	98
PID 1220 wrote to memory of 4260	1220	msedge.exe	100
PID 1220 wrote to memory of 4260	1220	msedge.exe	100
PID 1220 wrote to memory of 3700	1220	msedge.exe	101
PID 1220 wrote to memory of 3700	1220	msedge.exe	101
PID 1220 wrote to memory of 2052	1220	msedge.exe	102
PID 1220 wrote to memory of 2052	1220	msedge.exe	102
PID 1220 wrote to memory of 2516	1220	msedge.exe	104
PID 1220 wrote to memory of 4472	1220	msedge.exe	107
PID 1220 wrote to memory of 4472	1220	msedge.exe	107
PID 1220 wrote to memory of 5360	1220	msedge.exe	108
PID 1220 wrote to memory of 5360	1220	msedge.exe	108
PID 1220 wrote to memory of 3636	1220	msedge.exe	110
PID 1220 wrote to memory of 3092	1220	msedge.exe	111
PID 1220 wrote to memory of 1000	1220	msedge.exe	112
PID 1220 wrote to memory of 3788	1220	msedge.exe	113
PID 1220 wrote to memory of 3788	1220	msedge.exe	113
PID 1220 wrote to memory of 5260	1220	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v11K-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v11K-m5-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffdb110c188,0x7ffdb110c194,0x7ffdb110c1a0
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,2142741909293130524,11405420310793694881,262144 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,16255356454929009614,3187055402575766076,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,272638008836858355,6862808368336069213,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,3508198684053529321,14594611392813764255,2097152 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,15835694480098854383,2235419667885860105,2097152 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,6086051555259218198,10381683275808117872,2097152 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,7727979845515045798,16596066135627649646,2097152 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:9
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,1528866947641248955,15614315740011906433,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,12177170310829433108,2270890971602859554,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,3674394686173709013,15484640919140290622,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,3627003950310477590,17011459961649277141,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,3627003950310477590,17011459961649277141,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,9851718376618884343,11616192229042648137,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,9048134596966505446,13183672054759513190,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,15009769257937309508,7303770865137877567,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,10891269585293547269,4350468080642684890,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16592568375770307711,12987440317277854060,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,14672597180545035010,16996912970867292196,524288 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,1976759350890803228,9221740180897405404,262144 --field-trial-handle=2108,i,1478201481773143279,9238557107227463593,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a26d33bcef31d929f85945448cc0494bed7930d313795a73395e7d68f98ef48
MD5 36bcfc7ee32c539c5636a76e1cb30860
SHA1 119152f9f6685a52a2bbe1a6baa8c6d9883acc47
SHA512 2c607d0a37a0ef06860d4fe47ee4b362988a1cfc582931c3899e6779cba56e704067210b1703027e0d1f1919f8af6fb7a9dfe0f966062a20309f746a1eb2be5a
TLSH
T16C510980936739A1C3A8C5F2A9D15B683AFC80620D0F3A28455CAF343486F0E60E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59742c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59742c.TMP
Size 3KB
SHA256 2e1843afd996e7ec0aeda4d2a82d5fbcce1946290958c32079549c9fbfd3b82a
MD5 50ebb1461c0594e049b2a7610bd651df
SHA1 a2b547c3a58b5110f530ceadf5060f8b5c933125
SHA512 be348ec21a81c924016001d37c34cd75b5dfd24ca02269e6fd12b37c876ca34b53278bf3ca1330ea4df3309353b91db5fcf4ee15f2049d867e19eb8713be9234
TLSH
T14951FA90936739A1D7A9C5F1B9E15F683AFC84661D0F3A28455CAF343486F1F61E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 15e20b8cb704d687cd91734f49fb0ea17ad6c22a1ab0da0017c2e20359b8919c
MD5 c20550057b48100cac1b7d8f54631789
SHA1 f6c19643855f13a10b06ca4177df04dd0f8d8469
SHA512 fb877347455145f37d5839f47345099477048afd9d50e8b6761a018a0b5a3214542e12202773d68c534306cc8c81d9a11098f44b64f7627f4c3a87c8e1fce8e3
TLSH
T1C941BDF383F4857E8D0196F0AA146E1BCF2C0911432C7C5AC9E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f2ee2e6bed573a2afb24cd76e2d20423fa4af6e3fb332a50c811285ee8fc5b20
MD5 26c36fcb3738f7bc0557ca90d350ee26
SHA1 93f1ab2954b90a15b45a52b2c08ab384046be5f8
SHA512 5e72cf42bb42551ec042b28bbed705ef50e89ab7275f2802b8cd2fade214af0b2edbb7b6f40da78091187a492257be7b84d92fb1272ba7cb174bc1183bdec868
SSDEEP 192:sxRvRaCr/fLs29EZIizoA8p48/g6+WNIYn8UKhPG4IgVRDJ:sxRvnr/fLs296eJ/5ITxB5
TLSH
T11532B6156A68A93B5CC7E21DBB257F53E6F91022A1D51E48BAFC8A1C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 087febb9de23bae5eca34f4b62b10e3292cfbadb78b83f0be665a82ce8613163
MD5 d34191be3a67abd707d34456f0a3378f
SHA1 9240d0c28dba1329ac8551d3ff5f1a8fa0fe2ae9
SHA512 f2200cef35692e969529163577ed2b7a48ae15485ed4e50a4b87895e2bd5803f7e4a18b760ee877eac1662b356aecc7286f93b800d50a2dcdb31b3564556cd8b
SSDEEP 192:sxRYRaCr/fLsJ8JEZIizoA8p48/g6+WNIYn8M4hPG4IgD+NRDJ:sxRYnr/fLsJ8J6eJ/5ITdByx
TLSH
T19842C7556928693B5CC7E219BB557F53E7F91032A1D51E48BAFC8A1C04EBACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 af7d8ec8caf81f78f20849f44ad51b7c93854cf0425d054254c9047ea08e9863
MD5 72beb44cf2fc701941d84ccb99ba41b1
SHA1 a0ce373db2c0c61c8079f0f16a33b277ccc75e0f
SHA512 f9c0489c7d57e8455e7e989ec5f5557035caae17b01999831a2dbe6907fe83bdb48c277563aed67a51b348c21355dc4090f2e7f4baa18ef3fde0f098e9f9af4c
SSDEEP 192:sxRYRaCr/fLsJ9EZIizoA8p48/g6+WNIYn8UKhPG4IgD+/RDJ:sxRYnr/fLsJ96eJ/5ITxByD
TLSH
T11D42C7156A28A93B5CC7E21DFB557F53E6F91032A1D51E48BAFC8A1C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4c942166426c72112edf40f03bb3de42ff7d4bef1bdf0258666d504aab3d1cb0
MD5 a6d8639acf819e1feccff14f24008418
SHA1 f750bd2d2116305a06e23ed64e349f8d2ddecd12
SHA512 b8335b5b1f73086323756f9043ddc011bf8fe3cc5b46359c71e4ec65e40a2da0b008e1b50893fad2df6cd87108bbd2d72d0d874a993a20adbce289a95691c41d
SSDEEP 768:wb8dEg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlumu461rohzP1R:wb8dEsE7r6Wgouf6Mu1jaqumV6Ol9R
TLSH
T15BD2DB7B740DCA7E4F800ADDEC19BE9F6D6802CB5AD8C94047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bf93d3c9cf7a43c4e6a3d85344848e8616c30e5c4abe44e093be29282f5b3e25
MD5 70e3e7f941debc697e37bce2ff025ecc
SHA1 77790d2ab9fdd250b4b9a0c4b8b3b0911790be29
SHA512 9896b6e509a8ff008a7a34f94320fe76b7bbbb7a6d2c3d7124a1943a524534fba9a0a63e4b448f561c75af1aaa098431c5a248a1992627a2b4d433366d96d4c7
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHwBUAyeSIWWLbgIIK4Ng6Icoob6TZeFZTS:CeTieYgQxAl+eODgc1W+9M+XHwBUAyef
TLSH
T105912801347622903DBF661D8079A91EE6827873321CF56B37A851631FA7E165CFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 64f11a0b31844e0509ccc03e6dc574954f7f77c1b63a5547e8827fda63d1c00e
MD5 0e5e723f3be841916c94192f7700bded
SHA1 dda3754687bf82c419c81679ef8668952a2d67c1
SHA512 7a5208ee95d7141ddf20f63f2032b19da29f78e46ae37bebb5a48223cfe558502a6c7db137a54ec44402b5f8826138cb8495c0dc49b06e057716929d59830b9c
SSDEEP 768:trv+4UNbds3j6DZIO0tzNzc4ReyIs2xeVH1S5D:tbsbS3rztc44bs+EH1Y
TLSH
T12903DF32A839CD33ACEA6785F04776933EF8216B85850E94D9DA9F0C4A4B1DD174F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c28717da39ef4683f99b41aebe0c0ec57ab223dfdf7893367cec282d4e448cd1
MD5 425a00284cfe9b703567b0c72b026aff
SHA1 f23ba1b6708416e3adde6f280e712f91165c4cb6
SHA512 5dbb01377bca9b95c3f311f9170ff4f90693321d560ea477bba284494dbbccefaa75bf659f257df0f92d9c67d40867fc450d24e870ab66a1acad9f4aca3cc7af
SSDEEP 384:n3ZcI+38NN5his1AFJDZNfNoXOVSUUEqig3jYETRzcoXfK86sfxEZxxsIj4lBYQZ:/+3opQDZIO0trNzc4ReyIsPxPi9P6
TLSH
T1BFF2BF70A8799DA3ACEAA785F6423742BEF41177D5C41E88DADDCB0C098719E075F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 38d2df87f61298eae22db47c80dbb5cf579672ed594b0ab6c33aeabbf44c18a6
MD5 c9066ba5aab0ab963053b6b1b0a3a97a
SHA1 bd82886536bf685508c34c2e44012ce2227ac513
SHA512 c682ee8207010e3f3fdc5a1c306f269527cd2ac6b12c305ef0ebb4c2b2b98a653f0f901d540bfd48e28294c61b5a1e0e8d4e0798a3532c05f303c9c534c96e79
SSDEEP 384:nrZcI+38NNAhis1AFJDZNfNoXOVSUUEqig3jYETRzcoXfK86sfxEZxxsIj4lBYQZ:z+3TpQDZIO0trNzc4ReyIsPxPi9P6
TLSH
T145F2BF70A8799DA3ACEAAB85F6423742BEF41177D5C41E88DADDCB0C098719D075F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fa1d55a9093073b598ae4d56857129bfec544092fb5103426955b3a433564480
MD5 00c3254fa1d39fa11e0ede2909931b46
SHA1 23cf1d7988f9cc15ba7a3fa853213d9f75da0a8c
SHA512 b2b9ac446656baef1b22006802371cf5008575aeb0eb4e8bfe9a99bff75749133451234c66b49e0bb61ef475da3e9718bcd39917e371df9b54fb631afc268506
SSDEEP 768:drv+4UNbdV3TVQDZIO0tBNzc4ReyIsPxI:dbsb73TvBtc44bspI
TLSH
T17603CE30A838DD73ACEA6686F50736837EF4116B84C51E88DADA9F0C494B1DE275F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a8642aea86b63acf78fc4756e173ce7968fbc3ed5bfca0d8c1dfe91261d67502
MD5 294682d9069a4ad6fad253ccd6b5f03f
SHA1 77ab5caa50c3ad43f4299bdb6ab092431c18f612
SHA512 62a811d58ae57929d42dd450efda098d2b2a6d0d37e7018350abf5d702381f25bd5a1c7bb1685b6349b46b3b20f798be7811731bcc3384d336e2a5ebab928dd1
SSDEEP 768:6rv+4UNbds3YoDZIO0toNzc4ReyIsX8eVH1S5D:6bsbS3Motc44bssEH1Y
TLSH
T1B003DF32A8788A77BCF66785B54776537EF8512BC2881E84C5DE5F0C4A8B1ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e785be038c07a520740cc533f2fdba6b1b722d172996e7e4dcb61638c24f53f8
MD5 cae2dc711558feeb2856ddbc5e294586
SHA1 ef2f0d8fc0c8a294f1555eb7b1ed0af165aacf30
SHA512 569341528665a6e70397a2096cd542de587b1312ce9803b1eccbe932b333ca4b7d57846d53b3f1aaf6eafa914767f1541e00922338459caf74be572a4184b92b
SSDEEP 768:4FQO3QwgNp5Zw5O0trNzc4ReyIsPxPi9P6:bO3Gcrtc44bspPh
TLSH
T12C038D75D864CA6BBCFAABC6B7463642AEF01167C5C86DC8DAD99E0C04871DE074FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1220_277356496\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download