61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260817-xzy19sysc1
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4868	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314678992749640"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{30252A88-9614-4D34-95CD-CFDA83241F1D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
236	msedge.exe
236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4132	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4132	4792	iexplore.exe	89
PID 4132 wrote to memory of 4884	4132	msedge.exe	90
PID 4132 wrote to memory of 4868	4132	msedge.exe	92
PID 4132 wrote to memory of 3096	4132	msedge.exe	93
PID 4132 wrote to memory of 3096	4132	msedge.exe	93
PID 4132 wrote to memory of 3096	4132	msedge.exe	93
PID 4132 wrote to memory of 1420	4132	msedge.exe	94
PID 4132 wrote to memory of 1420	4132	msedge.exe	94
PID 4132 wrote to memory of 3564	4132	msedge.exe	95
PID 4132 wrote to memory of 3564	4132	msedge.exe	95
PID 4132 wrote to memory of 3564	4132	msedge.exe	95
PID 4132 wrote to memory of 6040	4132	msedge.exe	96
PID 4132 wrote to memory of 6040	4132	msedge.exe	96
PID 4132 wrote to memory of 6040	4132	msedge.exe	96
PID 4132 wrote to memory of 5476	4132	msedge.exe	97
PID 4132 wrote to memory of 5476	4132	msedge.exe	97
PID 4132 wrote to memory of 5476	4132	msedge.exe	97
PID 4132 wrote to memory of 4264	4132	msedge.exe	98
PID 4132 wrote to memory of 4264	4132	msedge.exe	98
PID 4132 wrote to memory of 4264	4132	msedge.exe	98
PID 4132 wrote to memory of 5420	4132	msedge.exe	100
PID 4132 wrote to memory of 5420	4132	msedge.exe	100
PID 4132 wrote to memory of 4824	4132	msedge.exe	101
PID 4132 wrote to memory of 2800	4132	msedge.exe	102
PID 4132 wrote to memory of 4824	4132	msedge.exe	101
PID 4132 wrote to memory of 2800	4132	msedge.exe	102
PID 4132 wrote to memory of 5920	4132	msedge.exe	104
PID 4132 wrote to memory of 3296	4132	msedge.exe	107
PID 4132 wrote to memory of 3296	4132	msedge.exe	107
PID 4132 wrote to memory of 4068	4132	msedge.exe	108
PID 4132 wrote to memory of 4068	4132	msedge.exe	108
PID 4132 wrote to memory of 2664	4132	msedge.exe	110
PID 4132 wrote to memory of 4420	4132	msedge.exe	111
PID 4132 wrote to memory of 3704	4132	msedge.exe	112
PID 4132 wrote to memory of 5688	4132	msedge.exe	113
PID 4132 wrote to memory of 5688	4132	msedge.exe	113
PID 4132 wrote to memory of 236	4132	msedge.exe	115

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x30c,0x7fff263ec188,0x7fff263ec194,0x7fff263ec1a0
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,6461196766411867725,17103734573879929192,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1968,i,16115349509688519313,16487815241812823579,262144 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,633693585521250555,10901142034855913090,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,16447425460489669680,10679596913072335882,2097152 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,5742091312461511338,4189754411707342216,2097152 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4376,i,6936925056076673861,235848201760326275,2097152 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,16316738357856843948,14485466752870592084,2097152 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,14863416577335919212,249819347276921751,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,17044144819823459368,17313313180188812287,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,12041180660817257085,8079127533036526587,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,14300774922528740900,7376975129680993975,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,14300774922528740900,7376975129680993975,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7724452210610637236,2360569029128260322,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,5801843136888008281,14581163618905585069,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,18274621428339699119,13649672600435502378,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,17891338399181537651,16948068569697178050,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,1970793283658587202,15929563786805953115,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,5211659828855084771,2266229771032610281,524288 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,5567743973230402381,17867914679044807273,262144 --field-trial-handle=2736,i,3850982230099395402,11639552027806974874,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a7aa05c82906bc3e4342c3c5b7491c048714e50a561438ded6835276734263c7
MD5 5d5afb33ccb15504b29a722bf4108bcf
SHA1 16b186e7436ba92762d64c44b5d31a261ffebd8c
SHA512 33b95a8862eb1ec71c8aab3359652e405b8c0feef5509b610e4f657db0179ee4fd8ef7e35d11e88be20b7e568b972a5ea1d16a937b0a85756720be4e3876eee8
TLSH
T14251528203263AC1E77955F297E944C8B7F9B3A9090B5EFA120C1C7A4E4EF4490C812F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a109.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a109.TMP
Size 2KB
SHA256 802d2490dca09182fcfce4dc1a0a446c24ba98719406abe379417440e54a8494
MD5 a4441b467786444df7a3a1546af92f18
SHA1 e2ca0823f8de6e20632a27dbccf88d7d591f1ef1
SHA512 8f173899eba5e2dff1fb3ea247cbd661eb418d18e4da5706a09a135c564837ba2125d4bd641fc426b8f4f66126c7da8e267dbcabdd1d539dfb4a332ff872a499
TLSH
T18F51658203263AC1E77955F297E944C8B7F9B3990C0B5EFA120C1C7A4D4EF4490C812F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e4d0abaa60fe82c80996a0d93d0f8f26b6e589811d61c1c51915adf0a0d1b2fd
MD5 587e1ceb59c2d1a930f0fd29b1673334
SHA1 3ae45e3415852705a4c6dcd0ff94352d5f3b0fc2
SHA512 c4d6146cde971207c111e3b80e5cebb13642c235ce2c8bd640045dd65ec168c5cdb4fcae92ff24e07041b86f0e8c3bff89f495199568fa149939f02e0b39774c
TLSH
T1A441DDF383F4852E8A0196F0AA146F1FCE2C0524432C7C5AC9E4AE2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 505cda6885950d943518b5664b61d3d58616d97bb72015bc691f3861b778e25e
MD5 b51f0dbf541daf3c0c064c68c89bc94d
SHA1 ffd65f4915f0493e59d7a2f00cac48738f51eefb
SHA512 66b6b2101c13b713e7789c1ca9df75e362ea21a6ad37c9cc02ee2eae5e251ee1fa70645e876f9feb29b0c45425e7a813e166c411ca7ddd6836c82cf015cdd085
SSDEEP 192:sxRJR5yM/jK1Ml8wCh/fxsxa2eZ9ySzoD8p4Z/g6+WNIYCNOuOIGgIgVcJ:sxRJb8h/fxsxNYrA/5I+wW
TLSH
T1E762E9156A34997BDCDBD20DFA517F53D6F81533A2941E44AAFCCA1C00E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 52f1937284caa715955afa865f9d13d467721a307e30f0275029284d009fca69
MD5 79f0d7b50422d09e7d2dacbc2e2ac6af
SHA1 d9a02860d0273e88cdcd91968034834a75b2765e
SHA512 bf427fb8b674846abae4422c800dbf1b0e07b88b0b1b2dc2b15d7a5a31542ba1942b49f786df3679150e7f81b9c29af018cc3f1f345e4b885abec44687e275ce
SSDEEP 192:sxRCR5yM/jK1Ml8UQ2Ch/fxsGk2eZ9ySzoD8peZ/g6+WNIYCCKuOIGgIgDLcJ:sxRCbqxh/fxsGzYrG/5IDw4
TLSH
T11B62FA15AA38997BDCDBD20DFA517F53D6F81573A2901E44AAFCCA1C00E66ED121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 89a6b555e1f00f2861e180bf1fd85b726a38f6252707107e668698998447ec18
MD5 28be32c01a12b1ff28b64ff21dc3ec12
SHA1 a7af27d0cc62c748209a1df3ff9d952136accd66
SHA512 d44a1d06824c4982e6414b18c03f0e9a399f6b9195c1847ce46ac4142b9fa2e412121e5b83f7cbb0779212047967168db7086c6fe1822e32fa62fcfcec396b4e
SSDEEP 192:sxRCR5yM/jK1Ml8wCh/fxsGa2eZ9ySzoD8p4Z/g6+WNIYCNOuOIGgIgDhcJ:sxRCb8h/fxsGNYrA/5I+wm
TLSH
T10A62E915AA34997BDCDBD20DFA517F53D6F81573A2901E44AAFCCA1C00E66EC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 461c9e77e9a338b7d44e1011ff54d5c98b5d60aef178cf3425ed496772173057
MD5 32a60f5c13171b2894e5ed74e432d8a3
SHA1 3acdfd9a92f5d5ece4c51239b515bdcbee7d4add
SHA512 f20c5176df383d35d2842147e29a8ddc8bc878045eb8f49bb83c2b680d220740e5e0696ea7181bb4d449969545ab4038ea91fbed19a3faa7a5929dd2a52ad480
SSDEEP 768:j/8vZN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaRMQqq1rov8+:j/8vZ7E7tQWgQ+fB+u1jaRRMVqOU+
TLSH
T124E2FB7B680CCB7E4F804E9CED29BE9AADE801CF5698CD5447EA840C03C57EB56164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b6ecf44c6d84db08bf183dfa42e657dbb08c8ab61ba1eae52d5b965c2c030bcb
MD5 e1040f7e99b96e7ab24e7049416f8b50
SHA1 91a758e7ecf797f55a48356471599a77d9997a74
SHA512 5442e65f31f27113ac5000a0dd98bfaad184ae2a58ace9617973492b54425a6a83de56458dd4b34ef199c8c1184272bab05baf513f63c0b46a3a632cf4a53e1a
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unODKK6:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOow0
TLSH
T18B917701757B52413C7E660D80BC893B868274B7342DF96B7BA841B60F67E42ADFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c4b045568e769c0bc94423cca41e14474c4dbdb06601f261ce07e9f5e118a02d
MD5 7a24c2d84af657d002101bae428e9191
SHA1 b056f070b8ee49839f2014b64959ac79e40da967
SHA512 ca97fb06c2ffd27ab3650247271392eb270468efc9d6d1dc24a2685ea22d7de18b2380173fa8495f0ba56a9412065c7e3b0d9038f4586eb8792617b7c3ec8d0c
SSDEEP 768:GR30g2Xu4p8+p3bd66j+4BRv86aLIWoPi9Pkt:GR30xuG8+p3Z6n4yCP1
TLSH
T145F2BFB1F8A9DD635CE6D744B2963743AFF425A3E5C00E98D8D8AB0D118725E1B0BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 db49391b0bb4bd4a6a4a3dad309261e991ceafa89b7873daadd93ed8bb894dba
MD5 db3f7ff5b3726db34741434f5c6478ad
SHA1 f2b7c7b8579cb6c445b12b9217edaa43bfa5ef77
SHA512 441e7de90a018d8189d11ddf441c72ddfcc4278d89f4bfc47a62a54546288a9634b79dce88642cf426934bfc629906c697e9f3ffc2bf9014350f8bb10ddd420e
SSDEEP 768:qF35gGQbxep8+p3bd66j+4BRv86aLIWoPi9Pkt:qF35+Y8+p3Z6n4yCP1
TLSH
T119F2AFB1E8A99D639CE6D74472867743AFF41563A5C00E88D8DCAB0D158725E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c7fed79e8690f2ba9ce44122e340e5f3e1d49f82cc85089d8f2c28ee0b0b1afe
MD5 022a520b93cc018abd245bb71efc8782
SHA1 f7c14a4193823042a2decbf7d9036b7d84ee57d3
SHA512 ca992bd7454f33d3dd23b5d0ff645b2829162c36442c3fe4286dbb3ecd7da72997dc238e045629b74779759507766f8675907fde0b36d1b619aad8aa91c493ee
SSDEEP 768:Irv+4UNbdD3accNp8+p3bd66j+4BRv86aLIiL2bwCl1:Ibsbp3aL8+p3Z6n4yN0ww
TLSH
T10B03CE73F8A899739CE6C644B2467A437FF811A3A6C00EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cbd4fa1d79021e81fd10ebdc2c36d59c027351bfd6571090b0b8ed0ea082313a
MD5 2a918caa05b8765b7e204bb436a3d47b
SHA1 298da5dbe352f098d72fe191b172ef63eed1a0dc
SHA512 b10b3d9a96788642f3e1b424b4600903941a5ff3b269bcee59525f9820071d0ce74965a3465e93cacf778f174b287b4abd2cfff06272abe75c1c260eb3ad9658
SSDEEP 768:irv+4UNbdS30k2XuSp8+p3bd66j+4BRv86aLIWoR3La:ibsbg30lus8+p3Z6n4yCE
TLSH
T17C03AF71F8A9DD338CF6D644B18677437FF821A399C00E94D8D96B5D019A19E2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 81df77c105c8d5a57485d8d79d847952f795e2860e5723bf593271efcabd116f
MD5 057ae395f6bfd3b7ea2874185cd8f9df
SHA1 1d871c84202b402d214ff1f5dfd7bec383346a99
SHA512 60dedf7fa7afb3c43e67ec34daf2924f9800b09ba7097fc1d7c381a228a55a3c21f36a44d365050ab3ec7c820cc081f481697d6f8016a5024fc5a5dc7aadbde7
SSDEEP 768:MR35g2Xu4p8+p3bd66j+4BRv86aLIWoPi9Pkt:MR35xuG8+p3Z6n4yCP1
TLSH
T154F2AFB1F8A9DD635CEAD744B2963743AFF415A3E5C00E98D8D8AB0D118725E1B0BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4cbf760563758ebb2951a83be4f8021fd418ff7a47fed4090525248a5ff2d0b7
MD5 c32a099f33913b748a46b91bc702ddea
SHA1 0fea3cd8b0f3a36a98339a123edaf8af1ef85a50
SHA512 81ad0d530874adfb60ac68c9d4acb56e10d8462fbe71760dbec022343696d59e6ce4bf52f028eb2604312099d951f7742002661b2635dce51b79e923d6744d3c
SSDEEP 768:qrv+4UNbdD3pEXuNp8+p3bd66j+4BRv86aLITo2bwCl1:qbsbp3wuL8+p3Z6n4yJ0ww
TLSH
T1CE03BF72F498E9739CEAC644B14677837FF821A399C10EC4E9D96B4E005A19E370B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7af4dda3-f7ab-4c41-a5cd-44e22b0fcfe4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7af4dda3-f7ab-4c41-a5cd-44e22b0fcfe4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4132_1552908012\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download