385d2d6ed3a18e7256ebad0a527a68c46a39f20b534cdd89528a3fb084525a04

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m5-eL.svg
Size 3KB
Sample260818-3xv5gsshkf
SHA256 385d2d6ed3a18e7256ebad0a527a68c46a39f20b534cdd89528a3fb084525a04
MD5 6543ebf56ad638c15bd11060b03b1eeb
SHA1 1deceeb76ff2eff0c2c0e8d5b6ba97d08e6c9101
SHA512 8979dc038d83456b9f3a34b8a476c0823e3800b4c565f2522c420a3d8e2b81998746773fd3e7429db629a460ed20176871e96eaf4d5c0031540ae10b9a696c11
TLSH
T19A71278876F83EEBC7C802970D41D8B84B2F946BD822978DD3CB94D879282AC735D570
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
208	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315708560256976"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{D8CA51C5-0025-41FA-9BC7-3E3335D3E953}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4036	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 4036	5564	iexplore.exe	88
PID 4036 wrote to memory of 5488	4036	msedge.exe	89
PID 4036 wrote to memory of 3640	4036	msedge.exe	90
PID 4036 wrote to memory of 208	4036	msedge.exe	92
PID 4036 wrote to memory of 3640	4036	msedge.exe	90
PID 4036 wrote to memory of 3640	4036	msedge.exe	90
PID 4036 wrote to memory of 2208	4036	msedge.exe	93
PID 4036 wrote to memory of 2208	4036	msedge.exe	93
PID 4036 wrote to memory of 6004	4036	msedge.exe	94
PID 4036 wrote to memory of 2388	4036	msedge.exe	95
PID 4036 wrote to memory of 6004	4036	msedge.exe	94
PID 4036 wrote to memory of 6004	4036	msedge.exe	94
PID 4036 wrote to memory of 2388	4036	msedge.exe	95
PID 4036 wrote to memory of 2388	4036	msedge.exe	95
PID 4036 wrote to memory of 4300	4036	msedge.exe	96
PID 4036 wrote to memory of 4024	4036	msedge.exe	97
PID 4036 wrote to memory of 4300	4036	msedge.exe	96
PID 4036 wrote to memory of 4300	4036	msedge.exe	96
PID 4036 wrote to memory of 4024	4036	msedge.exe	97
PID 4036 wrote to memory of 4024	4036	msedge.exe	97
PID 4036 wrote to memory of 3980	4036	msedge.exe	98
PID 4036 wrote to memory of 3980	4036	msedge.exe	98
PID 4036 wrote to memory of 1336	4036	msedge.exe	100
PID 4036 wrote to memory of 1140	4036	msedge.exe	101
PID 4036 wrote to memory of 1336	4036	msedge.exe	100
PID 4036 wrote to memory of 1140	4036	msedge.exe	101
PID 4036 wrote to memory of 4396	4036	msedge.exe	103
PID 4036 wrote to memory of 2484	4036	msedge.exe	106
PID 4036 wrote to memory of 2484	4036	msedge.exe	106
PID 4036 wrote to memory of 5592	4036	msedge.exe	107
PID 4036 wrote to memory of 5592	4036	msedge.exe	107
PID 4036 wrote to memory of 6132	4036	msedge.exe	110
PID 4036 wrote to memory of 2868	4036	msedge.exe	111
PID 4036 wrote to memory of 1104	4036	msedge.exe	112
PID 4036 wrote to memory of 4692	4036	msedge.exe	113
PID 4036 wrote to memory of 4692	4036	msedge.exe	113
PID 4036 wrote to memory of 2764	4036	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m5-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m5-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffeb61cc188,0x7ffeb61cc194,0x7ffeb61cc1a0
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,5812495902119314254,6894770291968306261,262144 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,8468824276649529791,1746284560026121278,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,12199935482090691587,4757901574250214723,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,847912345254731295,2199924759019187373,2097152 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,9266367810175637071,11537072335934704441,2097152 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,3206126956411742836,16238939892694808371,2097152 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,14878929029060308838,7169302297536645900,2097152 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,4151250738315627193,15609714031976832436,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,12253265933564703322,7541097380327403266,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,16140542257362457922,2074550629317414219,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,15540057292813521104,10488536840827679656,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,15540057292813521104,10488536840827679656,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,11834709151715592597,17455518252311532737,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11869247169605854922,8879651088908483763,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,593103109237066152,9702451933165349989,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,3813941672046340706,6261081243577991340,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,2862279037328772503,10021156734121663089,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,10747229809588088272,3457287093591432699,524288 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,7406408008992852542,15711316568530738099,262144 --field-trial-handle=2320,i,5522408605014772242,16132975885688117290,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 72c7c71bd77e46e4c21d058213d98beffa87b18f8433ed4c228a85bd4a339436
MD5 91a923874f5ac084266f6d0262257eea
SHA1 8fa4365ccf80db904eedbf679ffc59c6200b4c9e
SHA512 03af095d8a51ff85e549ba3c30c363743aad19a49560f6fa7a14f17c944a72761203370d69c4d566cf5a67335364b755e0db06eda4878e3eed6dd5b7c67a7dc2
TLSH
T12C517497B36E29C1DBB596F1DCDD944432F1C86822276F01865CAC7C1E06F0A6DD207B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a320e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a320e.TMP
Size 2KB
SHA256 32e03074932eae8cf062c09667d6a579b6e1c2faa4f894da9bb42202fd130542
MD5 a18649b55a65d0f2492468a56c366925
SHA1 e1a4484f0d074f5039444b5fa3980e49d0db0d04
SHA512 a433a4b3b1fc7543f8c863081fe6c1b84f071511a0ed69ea23bb4d46152f11bf4df5868cd32408148d7e4140420737d20dc594732f0005c251b2f5285d0b4b17
TLSH
T1CA517497B36E28C1D7B586F1DCDD944432F5C86822236F01855CAC7C5E0AF0A6DD203B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8ccbb5ff3b77b2b166ec77d9fea5af5cdd28e3d2eb1b372c0cd427b9e995aaf1
MD5 c66b826dc4a1f127093d07ebb24c5ff4
SHA1 412294cba0e003e747b5e5fd1c0ea60af54d61aa
SHA512 919ece3d96b43c586d4ec4a6a7448cf5cd796d7303039c8fb171d14fede5c12b6464b81dc98e696dd238c4e2df772d3ec1053cb27fc32bdc9ece500ffbf1f692
TLSH
T1D641BEF783F8856E890196F0AB186E1FCE1D0515432C7D5AC9E4AF2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 122a8c3387d035c4d37f92f7438ae8b2a45a4fea23f7a13f051f928f9c9c41f4
MD5 d4657a5670587547c201184dcbb4f98a
SHA1 998c0db1f3c2ec679daa8a795679b491ee46c2ed
SHA512 2a1b84c8a0010083adf2b8c74ae782cb6b191dda1980f521f6a337d07a69fdbcdedad950247ac876a1cc6fb1a0468edb159cdb7a262b8cab6267b2c5b1aed180
SSDEEP 192:sxR4RSCy/fbsC580HZCvYKzoA8p4F/g6+WNIYoBLCYY+GJIgDnjJ:sxR4/y/fbsC5805Cv84/5IcJ/5
TLSH
T18F42B7166D28A93B4CC7E21DBB667F53E7F9503260952E48AAFC861C04E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ccb325f46b9d2c482681c7d1003e6ba3c7bd63c6de1575b9ffbff5fed1359c3a
MD5 b847ebefd73116cb1c6766801ce35a45
SHA1 5831929fd34384065e99903676c7cf40c14c0667
SHA512 c2c1d177d87d98b6cbcbc0505a8bc5e5f38fc51ec3c427e6f23402652962f588b75b6abe8ae92cc94ccb9c6336903a23c3d8113e491f3f863a8555b9b3007e0e
SSDEEP 192:sxR/RSCy/fbsH5g0HZCvYKzoA8p4F/g6+WNIYo5zCYY+GJIgVjJ:sxR//y/fbsH5g05Cv84/5IQJ/r
TLSH
T15232A7166D28A93B4CC7E21DBB667F53D7F95032A1952E48EAFC861C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5f70fffbee35da25b4a21c4c98720c1b4c2169769945109e2ca45da2ac1a42dd
MD5 2d0954ebbcdf6fa774eda86aceaa2ccd
SHA1 c98864a1fc421aa0a0dcf77298cce7621619eb81
SHA512 66c06fd5f2592fd8d299ffd4db14f4aef57f0d1b98193cb96559b7a33c24a939679c8890eabe1c819ecd4fc322a5deb328a630aa6e45847a1314b217a403c3b5
SSDEEP 192:sxR4RSCy/fbsC5g0HZCvYKzoA8p4F/g6+WNIYo5zCYY+GJIgD9jJ:sxR4/y/fbsC5g05Cv84/5IQJ/H
TLSH
T1E142A7166D28A93B4CC7E31DBB667F53D7F95032A1952E48AAFC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 66bcbe4553e92c49d6045499d34a99525ed56dfb05d89dad683157a025f1ccaf
MD5 a92b04d968ec26a212a70c09844ce768
SHA1 f2c733387bc3210480aef1b06a51d1456b4c4e52
SHA512 9de14846389b9695dffd9ec7bbddc6f29fe5c95aba03e55e369454c9ea89cb8389d093e3f1bcdfb7d55f08813559b62534c15c5eacd5a9a3c67a94aa76294498
SSDEEP 768:j26Hko7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVwzBVuwAro9Ze0n:j26HkUE7MRWgs2f02u1jaHzB4wLwI
TLSH
T13BD2DB7B640DCA7E4F804ADDEC297E9F6D6802CB9698CD8047FE941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0e57a20-a91e-475c-b4d7-9b19b3366a65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f0e57a20-a91e-475c-b4d7-9b19b3366a65.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2b92315e7b490467b7cfb16f8ad976ac6db7f3af6a8f9c8371d19a0c3c207656
MD5 31b0bb75dc6de171350eb352d4a6dc54
SHA1 f061805406a254d38705715e0a3817c004996487
SHA512 021efec8d167800da21ec908ba8e83cc019a431cbd41703af741706e5d9c6853a05d1d6edede926f1d1d9f0ed55bf68e8d8f6e4b6520b72127c2c92254205f29
SSDEEP 768:eFQK39wgqzCxsOWJLt16uONXyer1IRCzni9oUn2R+:1K3bpuSIqn7U2R+
TLSH
T15A039D76D894DE279CF6A7C3B2567742EEF41073C5C89AD4EED95E4E008369E030AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 826270ce757ca8a2d03289fb17d6599643aaa89d8ac932dd1bd6c7f41a7c9aca
MD5 0faa63078466be405bb7d410388568a9
SHA1 b3d421fafd381579315c33cff18436fbe09f14da
SHA512 bbcf4a26d1bb03e28c94818dc7ebe68728941e4f2717de278a031c1fa5c6da18af8d05436ef059bfa3c7aaddf5a17997f9588528c5245a3d686eda3d19144772
SSDEEP 768:VB3zz9/TBOWJLt161ONXyer1IRCzni9oUn2R+:VB3VC1SIqn7U2R+
TLSH
T1D4F2BF72D9A5AE234CE5E383B1573742BEF86077D4C45F44EEE99B4E018365E130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 95c2c2ffcd5efdd835b7e4e5bad3c9462e8fc651ecdd53f6b3ae701e3ad21007
MD5 74fc296b988f3992705cb9fa0ea81606
SHA1 f19b6aa9ef8ba5607645fc81fbf3a8d3b23ed222
SHA512 e543ac8d5fc9c7ef20fe776e8278a6d12e6adb99e82cd9a9190f45aa3acc1ce8ad5dd30cbc98e5e5e861c66b0e303710b9fe478cb2df532b07b285fb6ff25eae
SSDEEP 768:/rv+4UNbdK3zM9/TBOWJLt16cONXyer1IRCzni9oP:/bsbg3yCcSIqn7P
TLSH
T1E003BF31A559EE334CE6A396B10777437FB8206784C04B50EEEA5F8E058769E270F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 118424d9945812400f19c6a190c0addaf8c94c9646232633296b814587281368
MD5 7593d2420257293f2f4432d4403ad6dc
SHA1 de76a87fbdfe1fdd35832481471d1c47087744ad
SHA512 e6dac49e70c8ed4d5abd4a34aaee054d3bc7d6dc068db281f552182490a555944bfab8939128f92c7ace034ba0f398f61eb755214e59c196da08b768e8083599
SSDEEP 768:hrv+4UNbdz3BI/TBOWJLtJONXyer1IRCzniB2eVH1SK7:hbsbV3izSIqndEH1l
TLSH
T1E503CF32A4A89E338DE2A3D6B14773037FB86057C6840790EDEE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 17197de46dded9134bb0115bf3c1f0c2e0ed06b7ae3367a8b29f57b0bc39c829
MD5 ce0421e5457d316b65b9db7dee8db502
SHA1 3394d7b133a6006cd2ad381f3808db77e6e74ad1
SHA512 407380aaa71a7c5559bd8cfdca1a6e500ec8cb4b12c7a192a0409f2e5a352d54d775f3b33358b9e40ae82c2bbbd2bf97f2d72790b6f3a9b46e81b654581dc877
SSDEEP 768:orv+4UNbdz33T/TBOWJLt16sONXyer1IRCzniwoeVH1SK7:obsbV3jCsSIqnEEH1l
TLSH
T1EF03CF32A099DE334DE2A396B147B3437FB82067C5804B90EDEA1F4E059759E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 016d480e5493148a34a26b320bfa59a060b073b6a5e2d3ca60770e4beee16e83
MD5 dd7b90fd2f938dde86b6825f4d97f1e3
SHA1 f47a138b3cf5f4606a6ed68e38b704eb14331565
SHA512 3dd0e5bc4f0a2dcdd5bff5a6bdbab27a3b6ed3beabf2f8432fe2e5906252918701d0326eca7bccb9ce7a83a81042d1190d1f9d6878e084d0e5ac4831edbedad3
SSDEEP 768:YB38z9/TBOWJLt161ONXyer1IRCzni9oUn2R+:YB3uC1SIqn7U2R+
TLSH
T16AF2BF72D9A5AE234CE5F383B1573742BEF86077D4C45F44AEE99B4E0183A5E130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee0b5238-98dc-420b-803f-44fe17ed6665.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ee0b5238-98dc-420b-803f-44fe17ed6665.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4036_51997761\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download