d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v10J-m4-eM.svg
Size 24KB
Sample260818-y152msgq4v
SHA256 d78815299fd2ba2b3fea05f7c5662295c55e9b87f5659718b5dfc273f4fe78dc
MD5 8c786d4da80ac1948a137a727a12fd7e
SHA1 0fb0844fb479811339f7104eb281a91b930ca91d
SHA512 838d9d0ec608d1e47dd3722b8ccd401e03eb334982cd433a7f896e66b62a9e69b9d2d3e8209914dd8563af8734ee368742a979b7e861efd480707c961c193a0e
SSDEEP 384:c5veJtU7WSADG+2tM8LSB7XXZwuw5wE1/7PRP3uDCr:c5vQjqZmDK
TLSH
T11FB21F6437F87C978BD803479D02FC68461FA877C4A8678D93D7D4E8A988368FB6C560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3884	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315577789747389"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{4EFF0714-E592-4183-9471-53135B80206F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1184	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 1184	5220	iexplore.exe	89
PID 1184 wrote to memory of 2008	1184	msedge.exe	90
PID 1184 wrote to memory of 3144	1184	msedge.exe	91
PID 1184 wrote to memory of 3884	1184	msedge.exe	92
PID 1184 wrote to memory of 3144	1184	msedge.exe	91
PID 1184 wrote to memory of 3144	1184	msedge.exe	91
PID 1184 wrote to memory of 5804	1184	msedge.exe	94
PID 1184 wrote to memory of 5804	1184	msedge.exe	94
PID 1184 wrote to memory of 4520	1184	msedge.exe	95
PID 1184 wrote to memory of 1684	1184	msedge.exe	96
PID 1184 wrote to memory of 4520	1184	msedge.exe	95
PID 1184 wrote to memory of 4520	1184	msedge.exe	95
PID 1184 wrote to memory of 1684	1184	msedge.exe	96
PID 1184 wrote to memory of 1684	1184	msedge.exe	96
PID 1184 wrote to memory of 5580	1184	msedge.exe	98
PID 1184 wrote to memory of 2228	1184	msedge.exe	97
PID 1184 wrote to memory of 5580	1184	msedge.exe	98
PID 1184 wrote to memory of 5580	1184	msedge.exe	98
PID 1184 wrote to memory of 2228	1184	msedge.exe	97
PID 1184 wrote to memory of 2228	1184	msedge.exe	97
PID 1184 wrote to memory of 3384	1184	msedge.exe	99
PID 1184 wrote to memory of 3384	1184	msedge.exe	99
PID 1184 wrote to memory of 3064	1184	msedge.exe	101
PID 1184 wrote to memory of 3064	1184	msedge.exe	101
PID 1184 wrote to memory of 1988	1184	msedge.exe	102
PID 1184 wrote to memory of 1988	1184	msedge.exe	102
PID 1184 wrote to memory of 4368	1184	msedge.exe	104
PID 1184 wrote to memory of 2768	1184	msedge.exe	105
PID 1184 wrote to memory of 2768	1184	msedge.exe	105
PID 1184 wrote to memory of 2752	1184	msedge.exe	108
PID 1184 wrote to memory of 2752	1184	msedge.exe	108
PID 1184 wrote to memory of 3664	1184	msedge.exe	110
PID 1184 wrote to memory of 4224	1184	msedge.exe	111
PID 1184 wrote to memory of 5556	1184	msedge.exe	112
PID 1184 wrote to memory of 3564	1184	msedge.exe	113
PID 1184 wrote to memory of 3564	1184	msedge.exe	113
PID 1184 wrote to memory of 3856	1184	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v10J-m4-eM.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v10J-m4-eM.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x304,0x7ffd1d33c188,0x7ffd1d33c194,0x7ffd1d33c1a0
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,5390789074236520980,10373739903064701216,262144 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,14219007031471314376,9138985299275352994,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,584398288779949278,5240977050461162580,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,9513659853670466750,3119872926572584687,2097152 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,12667691737121240923,5379508403049912741,2097152 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,15693043750888490815,13145653389410803050,2097152 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7892874633196972848,16952650171392534871,2097152 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,3628002096371267416,14269122927337432398,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,17447976257967386648,731398326830629751,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,8514862772984605553,5468089799176023459,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2419820867267328385,10610868724700188778,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2419820867267328385,10610868724700188778,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,11844674870724631907,11905457409907533387,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,12807666028448294561,17316875524571830218,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,6900500535363112035,11991671899191930870,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,5754335628994770012,2826082741596291035,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,5573327643986602761,10767275219134383679,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,10244658889286602896,10749745066416115216,524288 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,3333701015558396669,6500622548040235222,262144 --field-trial-handle=2120,i,12833073946692228033,6612636919845634365,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5b794742b35e58c2a2ff7d3e4dc85bf2c97fa8ea942e343682d21fbfbc33f7e7
MD5 4320b203b75710bfec329da0c44ad8ec
SHA1 144d5413734c08ba2becddb27f2307f3b172050a
SHA512 d2baa7fde4b4957c7dad5ba9a6e11411f36d50c215baa2bc2b396c3880b9dea6bdbe1eeb45f3af9ef0cd8d086c7ebd4099f87c3ea921932820b1f1be297121d6
TLSH
T192411E5C837CDFCDDBA409B1BCF0D6943ABED8CE0307AE50D4A41BBC4A02B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a2be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a2be.TMP
Size 2KB
SHA256 8c20e1d811f429a44ba4e9890d771d160dfb7bba3363ef41728d431c6e526d60
MD5 d365ca5c58765d0eef930d087eb754b2
SHA1 f226cb3ddcdf6ad4b71b2a8b9b5c07095449178b
SHA512 b046b2098ab2c681bad1ff30b4ff3bafc516066b6b83bca7cf2328d684de8fee86192d51ecdf680c5348cbf147639d7107a72bcd07b1cdfd8d3c5fd6c5fa1db0
TLSH
T131410D58833CDFCDDBA409B1BCF0C6843ABED8DE0307AE40D4A41BBC4A06B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 93cdd06380413afce27ce641be39cbd36b7af80a039b961d7c45cceaa191bae8
MD5 840b287f13f91e59d8deaa012a8fb99d
SHA1 0e997bd80bb2eab84f7e93efa857cad2df2eabcd
SHA512 00c5afeeba520fe03961e21eae525f1899282eaad21f49fe223647aa8bcbffe5aa629292dae96938816ee181cc8a7377117e4fc74194e4c1ef233fae9236f3fd
TLSH
T184418EF783F4856E890196F0AA186E1FCF2D0515432C7D5AC9E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e89ccc15eec75e90704e8d39e2db891ffbc8a6cc555b996e6e2b909b6a417870
MD5 d9769af7a7597387feb5794d5c08a3f0
SHA1 e62b0ce127ca8b6b7d1d97a63a6c1b166fba1a45
SHA512 beebca030dd55efa91e55e88fad3dec76047f792ae5f50158ebd0e295acbf3240c8ea7e2da3023fee9028fdb655611b58d580e08726761e816a1e4d6041cc2e9
SSDEEP 192:sxR5ReyM/jK1Ml8UQACK/fysB7qZEJCzoA8pe4/g6+WNIYn8Tq0h4GSIgDgfbJ:sxR5gqXK/fysB78Exz/5ITFGwt
TLSH
T1CD62D615AA289977CCDBE208FA51BF53D7F8547391941E44AAFCDA1C00E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4e3ee999081ee085974df8263602f8150b8c4b6fc4cfbdd7f78c9e28c84a702f
MD5 cfef0389e4cf057ef2a27cd21c1734d0
SHA1 03e91367148ee60d850fcd2ffff3977b9e5dd4c3
SHA512 f7da94cc286454a68729a86e2fa0851fd6b7db0272b19d3e26356a807a5baf8e2e88f3b0c7e13c3bd0b990166052f841ed587fdb016ddcdc6bceba0ff83ac2a0
SSDEEP 192:sxRyReyM/jK1Ml8wCK/fysrmqZEJCzoA8p44/g6+WNIYn8UqOh4GSIgVfbJ:sxRyg8K/fysrm8ExB/5IT8GVt
TLSH
T1D462D705AA24A977CCDBD208FA557F53D7F85573A1901E44AAFC9A1C00E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0fa871a43040be43e23cd8579783878bdef85f677f3d762fc17bd0b88aa0b174
MD5 c16062a158e6d8a2070d931bf9cfee3e
SHA1 fe54f93e6b8988cd8a0e061a8b5a6c3815e8e8c2
SHA512 92f3958eafbe002b438a425febbe2af5b387c14825557121d3566915a06b8d81b2085a6e105f8d9629b0ed901cc42397901457d70c556f951c31ba24079a9b4c
SSDEEP 192:sxR5ReyM/jK1Ml8wCK/fysBmqZEJCzoA8p44/g6+WNIYn8UqOh4GSIgD6fbJ:sxR5g8K/fysBm8ExB/5IT8GSt
TLSH
T19D62E805AA24A977CCDBD20CFA557F53D7F85473A1941E44AAFC9A1C00E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 413cd1f1a5fd9902ba00357aaf0c43d09d52c82ea1b2fca114c0f187991aced1
MD5 afd7566889f79fc3a425ef798972e500
SHA1 5f498357b0a8211b937c87088710613c18fc1030
SHA512 d8525288b85c9463f5d6faa7ee8d3f647f62b32c59de296815cf5a60cb2f9e079f6467d2014264c1c12f15266f81d7636585a3909ff74edc78ac211f15f2ea1f
SSDEEP 768:wGedmg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQrOu4YDroSwr8G:wGedmsE7X6WgoufDMu1ja/rOVYwxPEi
TLSH
T1EBE2EB3B690CCB7E4F804EDCEC29BE9EADA801CB5AD88D5447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fba6fd21a99fd715c94fd148f551cdfc9142bd8384a3d1abed031daaea1081e0
MD5 cf2843996a66f58a62c5690f3484b082
SHA1 6f321cc82f2a889935c85cc2e3487b1734d98034
SHA512 f6e0aeba4baff78232599939ba46dc8e964351d61d0a4837ee66e53105ee3a9972b832780c4ed871ef3d2b33aded993d7bc61e24a074ec8595770bdccf145fc2
SSDEEP 96:KRwBUAyeSIWWLbgIIK4Ng6Icoob6AFHjsJ9rhhdW18qgjbK4igtbcx50HPoHpm3Q:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhs
TLSH
T11891F355317E02413C7EAA0981F99C2EA3D178E23558B42F77E901E64F66E038EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 36681b5ca7c68d63fff7681294a4699c9394ddfaa8cd9a04cfbb9e588496144f
MD5 e35df2e8833dad5d6426b544816e9753
SHA1 ff1634a57b02737d13a9e26844b5d4e642348b99
SHA512 cdf2dfb376fa7b609ef37190db61957b28467cc318db7f3499100bfe62d6d98c9a49bc93f6da64c2c0cda2e42bf66478692449e2026df4e4e9bba37d7c335a14
SSDEEP 768:UFQL3kwgwtZQ5O0WhT/Nzc4ReyIsP8Pi9PU:3L3r/tc44bskPj
TLSH
T1B1038D72E964DD6BBCFA6786F7157242ADF45167C1CC6AC4DAD89E0C048329E034FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a2986045befaa0dfb8711328e630294212276e66c5632d2e5011460aa840d731
MD5 f22ada8126542c43315b2c0705bb32e8
SHA1 c26b04e5f2137e8c16f58ca217dfd161e035ed33
SHA512 06c82c3420376ed0374dec4cadcef8cf31b27a71eef54e795845cbd8613efd19d547ecbc8c2f9a691a9ef45cafd067c59720a646379475787bc237d2cccffd53
SSDEEP 768:frv+4UNbdl3kMDZIO0WhTgNzc4ReyIsP8Pi9PX:fbsbn3ngtc44bskPQ
TLSH
T15013CF31F528DD63ACFA6785F21732837EF8156B80C51A88DAD96B4C098729E135FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 81a616c842583b488aec1c6c0dba8a3c87f6f2f43d449997418bec38bdc9dd6a
MD5 2b1ba733d21a8ec9ffe0e423fd64b600
SHA1 0a352876c2487ccee6365f9be0ce24415dedffb0
SHA512 c43778cd76e6af252edcb8f60f632982029480a39cd948eb5e1c2abd4c16a979c9d33d21852bc86434ddc7bd80561281d03fa8a180b32f21f2b406314d3bee6c
SSDEEP 384:ntZcI638NRQhiCZiTCJDZNfNoXOVSUUWXnFLXoabcETRzcoXfK86sfxEZxxsIj4m:163eMDZIO0WhTXNzc4ReyIsP8Pi9PU
TLSH
T163F2BF71F9649C53ACEAB785F61632427DF55137C1C82E88DADC9B0C094329E075FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5acb2cee93bb1723b39de33b10b8a4877fd680c5cddf1129b5e482fd9d23c876
MD5 62f9681837834fece4ecba2a8c6b42fe
SHA1 8a02107e53981b1019991b5ba62a707d847f86bd
SHA512 482e8a4fc6bd6cc1e5fea926e1c42a9936f177a5da208faa8448583da1974016b332da7fdcce82d5515b67cfeb27d0af39315c25f85ef7afee14407c37a338f1
SSDEEP 768:6rv+4UNbds3ZPDZIO0W/Nzc4ReyIsXQeVH1S5D:6bsbS3Rtc44bsgEH1Y
TLSH
T18B03CF32E8788977ACF66785B50B76133EF8912782981B94C9DE2F0C4A4B1DD131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dfb396390a4b8647eaca5bfa8c1f9bb87203320f9bedfed839899fd66b14af30
MD5 632e4a3418d2a853c59d6ab075f96697
SHA1 23afd0adadf37c1f3b1dc7cb1a807826d81aa0fd
SHA512 644bf1be458916675aef0da8d2f2f6fcb84e8e20ba396f6b9e82ebf07e1bc58e4d191d2ba7e128d74d6ebac119a373e7620e48e18ffc61e080fd593405603c96
SSDEEP 384:nrZcI638NR1hiCZiTCJDZNfNoXOVSUUWXnFLXoabcETRzcoXfK86sfxEZxxsIj4m:z63DMDZIO0WhTXNzc4ReyIsP8Pi9PU
TLSH
T1EEF2AF71F9689C53ACEAB785F6163242BDF45137C1C82E88DADCAB0C094329E175FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 08606d4072802a22536f6b2c5d3e7b81824050466089318aca665ff3bf2530f0
MD5 5fb3bf124915add127c365ae1f829a50
SHA1 6488febee386c31a564120af7166e06e8282d431
SHA512 d95b63acf2b8eaef9ed07a8347ff605fb690a65f8abe40e268e9f06bf0f34eff05ba6e1838cca1402ce177ce5ab90425a8b12e3fb02c0758cf51418f21d15b6d
SSDEEP 768:Wrv+4UNbds32WDZIO0WhToNzc4ReyIs28eVH1S5D:WbsbS3Totc44bs3EH1Y
TLSH
T10303BE32E828DD33ACEA6785B14B72937EF8612B81840E84C9D95F4C4A472DE175F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1184_1140296145\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download