1d9b53e06f6dc11e0ed5e36f2b9db49ad3ec2e89d49c6a3145bac0b0f7d3bded

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v12L-m6-eH.svg
Size 31KB
Sample260817-xzy19sysc1
SHA256 1d9b53e06f6dc11e0ed5e36f2b9db49ad3ec2e89d49c6a3145bac0b0f7d3bded
MD5 fbe7ff2e86a8b54be74f27046684d50f
SHA1 b531c269cd2db0071d54af48acfcf7e7df75f30c
SHA512 1e387530138ff05234d0aac670fa1eeabdf79f57daa7d565eaadb6241cf5638f60fbc841c7bc635de7e0986733668e33b12bdf46261311276b0267c8b77cb8ed
SSDEEP 384:ccozyutS3CQImOyA5hE2hgo910mF6ezh5O+uSHS7Ix:ccoLxn
TLSH
T151E22D6537F43C978BD803478D42FC6C469FA8B78498678D9BC790E8A94C368F76C5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314678998379997"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{6491DCCF-50AD-451D-BB80-26537BE97CA4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5708	msedge.exe
5708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3176	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3176	4500	iexplore.exe	89
PID 3176 wrote to memory of 1960	3176	msedge.exe	90
PID 3176 wrote to memory of 1172	3176	msedge.exe	92
PID 3176 wrote to memory of 1064	3176	msedge.exe	93
PID 3176 wrote to memory of 1064	3176	msedge.exe	93
PID 3176 wrote to memory of 1064	3176	msedge.exe	93
PID 3176 wrote to memory of 5264	3176	msedge.exe	94
PID 3176 wrote to memory of 5264	3176	msedge.exe	94
PID 3176 wrote to memory of 1212	3176	msedge.exe	95
PID 3176 wrote to memory of 1272	3176	msedge.exe	96
PID 3176 wrote to memory of 1212	3176	msedge.exe	95
PID 3176 wrote to memory of 1212	3176	msedge.exe	95
PID 3176 wrote to memory of 1272	3176	msedge.exe	96
PID 3176 wrote to memory of 1272	3176	msedge.exe	96
PID 3176 wrote to memory of 5784	3176	msedge.exe	97
PID 3176 wrote to memory of 4368	3176	msedge.exe	98
PID 3176 wrote to memory of 5784	3176	msedge.exe	97
PID 3176 wrote to memory of 5784	3176	msedge.exe	97
PID 3176 wrote to memory of 4368	3176	msedge.exe	98
PID 3176 wrote to memory of 4368	3176	msedge.exe	98
PID 3176 wrote to memory of 4376	3176	msedge.exe	99
PID 3176 wrote to memory of 4376	3176	msedge.exe	99
PID 3176 wrote to memory of 4232	3176	msedge.exe	101
PID 3176 wrote to memory of 3892	3176	msedge.exe	102
PID 3176 wrote to memory of 4232	3176	msedge.exe	101
PID 3176 wrote to memory of 3892	3176	msedge.exe	102
PID 3176 wrote to memory of 1232	3176	msedge.exe	104
PID 3176 wrote to memory of 5892	3176	msedge.exe	105
PID 3176 wrote to memory of 5892	3176	msedge.exe	105
PID 3176 wrote to memory of 2020	3176	msedge.exe	108
PID 3176 wrote to memory of 2020	3176	msedge.exe	108
PID 3176 wrote to memory of 3828	3176	msedge.exe	110
PID 3176 wrote to memory of 1420	3176	msedge.exe	111
PID 3176 wrote to memory of 3024	3176	msedge.exe	112
PID 3176 wrote to memory of 5272	3176	msedge.exe	113
PID 3176 wrote to memory of 5272	3176	msedge.exe	113
PID 3176 wrote to memory of 5708	3176	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v12L-m6-eH.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v12L-m6-eH.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa7789c188,0x7ffa7789c194,0x7ffa7789c1a0
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,5457474410623465666,9655685975114833223,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,3649559491732424551,13824364759497418340,262144 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,8879780991704412973,14726189651905035882,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,2784712012544533747,7537982164528571766,2097152 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,4796560864817487998,8294624603099852268,2097152 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,17100346379648352792,1582395941754222338,2097152 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:9
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,13116007023018430401,1095798550531365636,2097152 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,8502248457427585970,17507280912025606306,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,5898860444729026538,80073937276308674,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,13305044456727702295,10933190405525762513,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,5858291499763587978,16220323821936237006,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,5858291499763587978,16220323821936237006,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,3456448709347639435,15630669699998688571,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,7179323814437216047,14291960497108985388,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,1129197395534983294,7460864315965075951,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,13082004208650564534,8867034881949963123,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,15027862768518284302,2712818185423956156,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,11056608693421071443,97762092647126885,524288 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5812,i,8200579342988080637,9247678311378558125,262144 --field-trial-handle=2384,i,14188712097352079017,10856947534332116262,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3ce362e4ede5e22b8f4a1841ee33cf812ef3d8c6980decb4ea1124b58ebc8f1d
MD5 36b0dcd9f3269e0bb78a0cca84593d45
SHA1 e60d32e5f2fb80539f631c5c78507826c4c49096
SHA512 4fced5d08bfa5d1a4ed65a5445c3345d0ce56e76c790a0cb19e77f229a908db739dbf245b8ad14b2846c9b85140ff36aea54a42160a975f285092b9102a2dc20
TLSH
T1D161415963210EE3EBE5C9F196E1B48831F78C61450BAB3A4293ADF068AAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5918dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5918dd.TMP
Size 3KB
SHA256 2009c95887b37d031f64d41e59dc8c950602d796d1ca589487aa81221a7b54c6
MD5 534ecd00fb2de75b5376bc49dfd7649e
SHA1 8321a13d850450a4cd4b85991dbf2e70dd2f28c5
SHA512 979cb44bb35d12823f2f360881d1ffddae7fa70b656ed3b4b1dcd057826622530feb11fe70f67f2f7f40f392388d533a5cc8ba0f08e4a3b3f6e46a397905a4e4
TLSH
T1C061535963210EE3D7E5C9F196E0B44831F78C61450BAB3A4293ADF06CAAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d6f86cb2dc1c98871221e5d0ce165be6c67af0bbbd178ca7e80d7ab10f00fad8
MD5 fdce4a0b202cdaf73dbdb52ce9b6cec4
SHA1 8c95f20f214372abb776933d0fc7540f7d51a788
SHA512 20b7322ca36cfd4939b7b4f1402011ae2c0109dce760a59b77bc9d356234a5824e7c2f561b05b54f979d595f9b2ba3137221566148d9a8a6a12cff8226d73265
TLSH
T1C041ADF383F4856E890156F0AA186F1BCF2C0915432C7D9AC9E4AE2793E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 82d49567a489e746c2a24e4fff857bfe2258ec4ebedb1b1da3fd2794bb2a77b5
MD5 64bb5c9be09b1519c0cac07ae177914d
SHA1 9e4219304edd55b557f4909e7b4112ff7254ae03
SHA512 1e09ca7f6a8e2504a643c03ded3e25146a3d43cdd5439a75c29c2c0e233016739f17833654a48ff800d4b78386140b12e5121904d516585ae096d7f0d2e00cc0
SSDEEP 192:sxRQRYC5/fosypFFEZeQkzoA8p4c/g6+WNIYn8SchWGMIgDhwJ:sxRQ15/fosypP6bFx/5ITjOu
TLSH
T13742C716AA28A93B9CC7E21DBB157F53D7F91132A1D01E48EAFC8A1C04F76CD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d13957a1587c0206b9567c7a92302a5b5797882bb10fac2c7967a783b009f0da
MD5 926669faef09767bc7e38f4ad31e835e
SHA1 fcead9f6234ac52361c15a673a70ffbe6b336032
SHA512 6091f542c58c011a9007de9e670427dc3e11c58a40d6e6830514abb84873d31ded219fba4fd87ca08a83c63c29c2357533b66f3246acb793b810587c8509f3db
SSDEEP 192:sxRDRYC5/fosZpF0EZeQkzoA8p4c/g6+WNIYn8UGhWGMIgVwJ:sxRD15/fosZpq6bFx/5ITROG
TLSH
T11432C8166A28A93B9CC7E21DBB257F53D6F91132A1D01E48FAFC8A1C04E76DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 829d1f6ebe9b264ca40b0c0798ddff1a4869248cc238247eef742a590bb88a47
MD5 ed01dc4465a09f533a936e67cf9b096e
SHA1 d87e692d4a2fc09dcc955cc9cebfa203a9c1b32c
SHA512 32dbc03e041ae9baf6a14cf5e612d6c4d6b7de5c15589de0152d7ef705e386a7ed6a74f3d2910eb21787fe49c993ca01e3441cbe87aacc694d8aa0c6d3b8d6a4
SSDEEP 192:sxRQRYC5/fosypF0EZeQkzoA8p4c/g6+WNIYn8UGhWGMIgDDwJ:sxRQ15/fosypq6bFx/5ITRO8
TLSH
T16F42C716AA68A93B9CC7E21DBB557F53D6F91132A1D01E48FAFC8A1C04E76CD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 47996108bd2d6cfc2ceb58a539763e7ef57b639744d0163811abd5ed35fbb137
MD5 189b8f738bd9ccdd662d6e0f35f8db4a
SHA1 7733bd6403b6aef3dce982dfe455da4216cb002c
SHA512 7db88e74e26ba7e1912ae42bf62b983382d364d7830596ee47c6685208f2f829cef630bc7a94f5ef8c7be909b0eb348be8fa945c2944e18c938a24f282448a06
SSDEEP 768:wb8dlg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSomu46Qrohnn51:wb8dlsE7r6Wgouf6Mu1ja9omV67tX
TLSH
T1A8D2DA7B740DCB7E4F800ADDEC19BE9F6DA802CB9AD8C94047FA951C02C67EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59edf0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59edf0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fdfe2b1d2877ba6e7d4e2ea920fe7e02f33963fd0820f14dad88aa5ab0c8ea83
MD5 4a16c52a7c9191e70eee36b3cb34b15d
SHA1 1bb52652de0f12d1f9ffc2fc40f6e95ccc4db092
SHA512 e68f137774d7ab1d79f92debf1a0824c3b96658e78e077f657119f73d965c068d0b612d467d5b5cf77efa77079e5e133354b120e70f6fd6255100d7f81aca9b2
SSDEEP 768:AFQh3rwgpekZw5O033NNzc4ReyIsPAPi9PsZ:zh3nctc44bsIPJ
TLSH
T12A039D72EC68CE6BBCE69B86BB067642AEF41167C5C85DD4DAD99E0C00831DD074FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 35d98d16f83137c4954a82b8e6a2272dfdeca24dbcb4ab43e32c53f72d9b6fc0
MD5 8a3cedf2e34d5b2a3d1742359be8b4fb
SHA1 b0fec97152adc21f52c7d4f017c76dd99a539050
SHA512 c0352842f0a0be00da8e558dda5cfc9790c6b6b97a9c499114790aabef144b314bd2b95be6ffe91d7a95a259364869dd2d08410104d2c6b77a28fb263d360d45
SSDEEP 384:nmZcI938Nw8Rb+5C2JDZNfNoXOVSUUHXCDOHIETRzcoXfK86sfxEZxxsIj4lBnAR:093SedDZIO0333Nzc4ReyIsPAPi9PsZ
TLSH
T135F2BF31AD289D637CEAA646B70732437EF4216BD1C41E98D5ED9F0C094369D0B5F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7fe88e56e00c63524765f738a3f510cca67cad9ccba51d80aea76d98d9970d39
MD5 463ca313f0a1d804d3626931d136bd1f
SHA1 f2669477e5c6a0c10f56f69b7d9b1c046474817f
SHA512 1107a284dfa277b75dfb7cfd0f131e10d4ca2fa5e0f0e40983a3673cb1808d77460df33a6603bf57873eb13a9afecf0cd66349f6fc2a40476494928418e8aa7b
SSDEEP 768:6rv+4UNbds3bHDZIO03SNzc4ReyIsXNeVH1S5D:6bsbS3Ntc44bs9EH1Y
TLSH
T10F03BE32A878D977ACE66686B50775533EF8512B82C81ED4C9DE2F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a4760baaed337255d46d36084763665dec3ed227873e859eec611b7040cd2d46
MD5 3799b2e0028c52d3fad7d77cc0cda30d
SHA1 7d53fa6d5c5553e8211d771d14e2c9b1504ce9b1
SHA512 4d3cd53bb7f6c4aa9f55eadbe775d84d63341938a7a9f7b0126049d627f1340807f10f60903ee928c2de5a59700f4be10622bbb26071fd3b83e6bf1ec5a7b100
SSDEEP 768:Yrv+4UNbdu3XEdDZIO033DNzc4ReyIsPAPi9Psc:YbsbY3XXtc44bsIPs
TLSH
T15A13BE31F92CDD63ACEAA686B60732437EF8216B81C40E98D9D95F4C0A871DD171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 639ae32429efe9aceacee125575ca4a9bb83818b159fc3b4cb106b0a0f62e3b9
MD5 1ea880c252059f3cf17bd038b0a8e283
SHA1 df1c5b63a0b0f79a4036d28c3b9fd57bbd2f07eb
SHA512 2c127ec4c131471e97f0c04c879c970c3fee3ccad655aec0e521a8a4bed0e309e4dfaa2dd5e2e9cd048de778460bc6cc376f069766ead6dd3438a687b755d54a
SSDEEP 384:nOZcI938NwVRb+5C2JDZNfNoXOVSUUHXCDOHIETRzcoXfK86sfxEZxxsIj4lBnAR:s93tedDZIO0333Nzc4ReyIsPAPi9PsZ
TLSH
T13CF2BF71AD289D63BCEAA646B70732437EF8216BD1C41E98D5ED8F0C094369D0B5F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 79bb4a0b988449ab73332aad66ce0ebb5f467ebd6ffe1da0d8b74a36b3392366
MD5 084ef5151e54dc4fefaa2b4b3856186a
SHA1 1c0a4bd8bf9f833fe322383dc45879e29b3fa46b
SHA512 0efb687bf5c1b9c32b3ae73bff26395b8a054270456b65e6685f6d2da21adc08dd72dd57bd49ab0c490186696b234c9faaaf85e139daa8d5175a0491aa4132ff
SSDEEP 768:drv+4UNbds3XDDZIO033GNzc4ReyIs2AeVH1S5D:dbsbS3Ztc44bs7EH1Y
TLSH
T14903CF32A878CD33ACEAA64AB14772937EF8216B85C40E94C9D95F4C0A471DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 913c52ff02981897d76c8f3f35a70c7b50ccc2b131e4faba5644e48a82dca115
MD5 4b38cf715cb1e4f8a75baf5743980105
SHA1 8aae0fa6292e283a921ab807cdbb42afbccad9be
SHA512 9c5a6ecf774c764b5a707f1207f60d1169000b2d720295cdfa866250b2bffb140cd6ebabbfbfb2d59120b850f39123adc66d7efa76e1b09c7ad6d999b79d411a
SSDEEP 768:8FQh3rwgpekZw5O033TNzc4ReyIsPAPi9PsZ:vh3n6tc44bsIPJ
TLSH
T122039D36E964CE6BBCE79B86BB067642AEF41167C5C86DD4DAD88E0C04831DD074FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b97ac35-2f53-4e4f-a4c0-1b9ea277a8fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b97ac35-2f53-4e4f-a4c0-1b9ea277a8fe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_330547277\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download