09a1145a6620c24ca73c44e23c31f7917816ed9ffcb17a8295cbcd67d88745b5

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m3-eL.svg
Size 3KB
Sample260819-25pf8sysht
SHA256 09a1145a6620c24ca73c44e23c31f7917816ed9ffcb17a8295cbcd67d88745b5
MD5 8a97a3e2ea7103a874e7c9a32e7ed545
SHA1 b450e9e2801ae7e10cb96224461aeddb11dc1ef7
SHA512 7303da25aa0029a146545b8d2046e553d7c07cc7ad7a6942065592fa27b645f0a9a88448251d474773f712b5eafff6d8b4ec09bfbd1a490865583802a57df4b7
TLSH
T12A61168876F87EEBC7D802530D51D8B84B2F946BD822978DD3CB94E875282AC735E570
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2700	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316546205666475"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{4CEE038D-B8A2-4501-8DEB-CB10466861A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3492	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3492	4164	iexplore.exe	89
PID 3492 wrote to memory of 4328	3492	msedge.exe	90
PID 3492 wrote to memory of 2700	3492	msedge.exe	91
PID 3492 wrote to memory of 1108	3492	msedge.exe	92
PID 3492 wrote to memory of 1108	3492	msedge.exe	92
PID 3492 wrote to memory of 1108	3492	msedge.exe	92
PID 3492 wrote to memory of 6032	3492	msedge.exe	94
PID 3492 wrote to memory of 6032	3492	msedge.exe	94
PID 3492 wrote to memory of 4492	3492	msedge.exe	95
PID 3492 wrote to memory of 5672	3492	msedge.exe	96
PID 3492 wrote to memory of 4492	3492	msedge.exe	95
PID 3492 wrote to memory of 4492	3492	msedge.exe	95
PID 3492 wrote to memory of 5672	3492	msedge.exe	96
PID 3492 wrote to memory of 5672	3492	msedge.exe	96
PID 3492 wrote to memory of 2352	3492	msedge.exe	97
PID 3492 wrote to memory of 2352	3492	msedge.exe	97
PID 3492 wrote to memory of 2352	3492	msedge.exe	97
PID 3492 wrote to memory of 2404	3492	msedge.exe	98
PID 3492 wrote to memory of 2404	3492	msedge.exe	98
PID 3492 wrote to memory of 2404	3492	msedge.exe	98
PID 3492 wrote to memory of 2420	3492	msedge.exe	99
PID 3492 wrote to memory of 2420	3492	msedge.exe	99
PID 3492 wrote to memory of 3004	3492	msedge.exe	101
PID 3492 wrote to memory of 3004	3492	msedge.exe	101
PID 3492 wrote to memory of 5556	3492	msedge.exe	102
PID 3492 wrote to memory of 5556	3492	msedge.exe	102
PID 3492 wrote to memory of 5272	3492	msedge.exe	104
PID 3492 wrote to memory of 5676	3492	msedge.exe	105
PID 3492 wrote to memory of 5676	3492	msedge.exe	105
PID 3492 wrote to memory of 4888	3492	msedge.exe	108
PID 3492 wrote to memory of 4888	3492	msedge.exe	108
PID 3492 wrote to memory of 3504	3492	msedge.exe	110
PID 3492 wrote to memory of 5268	3492	msedge.exe	111
PID 3492 wrote to memory of 760	3492	msedge.exe	112
PID 3492 wrote to memory of 1632	3492	msedge.exe	113
PID 3492 wrote to memory of 1632	3492	msedge.exe	113
PID 3492 wrote to memory of 4132	3492	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m3-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffd082bc188,0x7ffd082bc194,0x7ffd082bc1a0
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,17396130361941529868,3483245460918333135,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,7639057868674165588,6678746748450892885,262144 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,8705881441196249593,15974202519826864047,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3664,i,11643361093011433366,2113890260289851479,2097152 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3688,i,14655609326738251694,1058389544965578324,2097152 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,1830685122068994085,9881028928844083164,2097152 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,7682640544227272639,4303983546692514617,2097152 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,2925678525310019389,5170845401617644978,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,468396583326010309,13473031816260514313,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,6467231598999722083,16684843939283928712,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7934293868847711942,241347793370542383,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7934293868847711942,241347793370542383,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,2072069330965861643,2787051764998977235,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17543365823332220079,9109466346506425313,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,16009546009705842028,15366531645511021877,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,13050604439966479624,16702258380684385855,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,4832346431794829024,8243245679972718142,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,2743833319010061789,15335465043356878044,524288 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,14554529724950498899,644147032994576882,262144 --field-trial-handle=2596,i,11050977648107769817,7938019684889816376,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d9d18eb2e5eb19f3486e9fe59a93b30a08dd6a2fdbfec6c4ce09813416a3aa3d
MD5 2f9454f9f27359a4e6b597f80fd359b7
SHA1 f7179cdd8a54db1f574738e9ec9e6edcf5208c64
SHA512 672f7d9fa92321f90386f92c532e8a84c9e3d7c0607a390b05cd94a79928f738020d7a2e182c05e7cc4d03fef959d4e5cb8907dfcd7406b299707c01996f4daf
TLSH
T16C51849143E31AD9F72D0BF262C71C5AF67777664687EE1200CAA9364C0E36E8321DD5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b462.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b462.TMP
Size 2KB
SHA256 08dd69ef50682bbfc44b04deea3565b9c1e7958ca4791f7815b90b00a95cde71
MD5 1a0c5b089fe4331a6fefaca26fd3ecc5
SHA1 a3545f55b1a47334a8f0a5a011f37cc59032cc7b
SHA512 b60243a8c29822e8a02f55fb2ed1e8e23924901fd22ba4484c6313689100c8a676082c22b0869e0d44ed340d2f745a4d1663306c5fb43002791baf34474f1cbf
TLSH
T1AB51739153E31AD9F72D0AF262C71C5AF677B7AA4587DE1300CA59364C0E32E8322DD5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8eb74dca-8737-4ef9-89df-04f22ebed9a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8eb74dca-8737-4ef9-89df-04f22ebed9a9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c73eb0f9a4593c40ec2d3797220bc2a015b8039d698713fc797c1161b019c06c
MD5 3278f00e378024265a1238ea88d1d053
SHA1 b824aca7af685dd16276609a3ff05010d5ba36cf
SHA512 5f87e63064e38b10e04492205b699299ecb6fc8a09ebf7791aa8c7ecee54af9b9e6c1c637e06085ee1718ae9d7cb62ee82ea039ea970d058e5845d6a6757b463
TLSH
T14F41ADF783F4856E8A0196F0EA146E1FCE2D0915432C7D9AC9E4AF2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c1952d033c015ac503b1aa1fd6e6daedad36bbfd769917f3d7851b1e43b37625
MD5 f397250f4691f5b88d49397fbf8b3dd8
SHA1 0367624d378d0819817b6bfe1cdf1fd4e31d0ef3
SHA512 ccc641045911b813e7b2a98aca69ab070b41f28d7794c63b0ab3b8e34588e1f6d3c3b9dfeb2339960f076427feb6d93561285da6092a0c3c4d99ed67a016c500
SSDEEP 192:sxRWR0Cr/fOswblZKRTBfvzoD8p4A/g6+WNIYGlbvkIYGUIgVsJ:sxRWhr/fOswbLK9N/B/5Iofq
TLSH
T10632C8196D28A93B8CC7E25DFB25BF53D6FD503260901E48EAFC9A1C04EB6DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b69547083c7fe0dcd543133381571f02cd611bbf4a2b559644f244cc35153168
MD5 2244fa428a8df1a84c68852891f6639a
SHA1 39facf4b6e76ce7cde65a55cb8ce6da1aff6a760
SHA512 d2a117e9c70d6ab1831dee45e18bba983083d2da63683fa1bdf38cb43c89ee803a139b47ec479f76d77c4b3c47b79a4239af59ec1ad2f4465be05d2fe50b2b87
SSDEEP 192:sxR5R0Cr/fOs8AlZKRTBfvzoD8p4A/g6+WNIYGKeFkIYGUIgDusJ:sxR5hr/fOs8ALK9N/B/5Iifj
TLSH
T17942D8196D28A97B9CC7E24DFB55BF53D3F9503260901E48AAFC9A1C04EB6DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1dbfb98b61d265391815fb8dbfd637c5f15ade8d5c45ddc3ae0ed116d55d8e4a
MD5 d2b1c1a3541ae897e07562a5708791db
SHA1 0a60684ffc6af7ea9e0a613172d47d20419d4a55
SHA512 646a50efc39ef25d515e9c03a47c21300312b7760530ac0d06147be513b3a1e562c061acec9a1a445c1457abdbc211d4d75670c026b22d654fdbeb26170bca0c
SSDEEP 192:sxR5R0Cr/fOs8blZKRTBfvzoD8p4A/g6+WNIYGlbvkIYGUIgD8sJ:sxR5hr/fOs8bLK9N/B/5Iof9
TLSH
T17642D7196D28A93B8CC7E25DFB65BF53D7FD503260901E48AAFC9A1C04EB6DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 25374081eea8a4714a30e3db06d8a0ededc458fc90b94963ab074756e009ab04
MD5 81e50e012384f77987bfa03264fa3f8b
SHA1 6dd450b95a7bc4b2699eaa57513f5fd7a5ce302c
SHA512 187b68a119b5c15cf7f8dc9f144ffef2de37056f10731426a3a405b26a65373f01786ad51893dff93e834d084990e1c74acac3bf19e6926f37a0e5120d009d78
SSDEEP 768:UQYi137pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVih5pNKmrotR:UQYi1xE78NWgv7fxJu1jaVh5fKdtR
TLSH
T1EFD2DB7B640CCB7F4F804A9DAD197E9F6DA802CB9698CD8047FE941C02C6BFB51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a6880d3c067274abb0a1473ab2c1086598007e9ad765d666e8e32ae5f01a5985
MD5 5f07f2cf4e192a52d8157e99aa97e01d
SHA1 2cfefde2fb84152ce776090d8ae097f9b46ce457
SHA512 fb62c93351cf85afa055396bf71aeb61648c612f42ff0361caf2e7a9ed92118b395ac6f743cfa5fd16bae5aff2302c2705fa4c9b61ebd56b46b9a91cd3c00150
SSDEEP 768:JQ3b4SVaCOI7Hucys6BRvi82oP4/z6himo6geHsq3:JQ3rXC3imOz6ImoneHsq3
TLSH
T1BEF29E34E865DEB7ACE392C6A6457B97AEE1122381CC5DC4DDD96F0D10C76AE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f20a788ae79f190653263dbc436a6108e37ce2bfe3cdcbdc3d3a279960c42f03
MD5 25b5ea1efbd89314a4a21fedb0ef2373
SHA1 aa66b7cde8b3b9a06c8a467131037458208b9397
SHA512 0b08832a8525ebecd5d22bf46afc3d0e7f9463f05c115d2bd162654acafcce75f528bf012eb619f0721a6eb601944361e1952eccf129ffb500393d8008ea4b62
SSDEEP 768:4rv+4UNbdS30HlYyJaC57Hucys6BRvi82oP4/z6himofg2bwn+h:4bsbw3iXo3imOz6Imo40w+
TLSH
T1D003BF35E418DD72EDE79188B44A7BA37FF5127344C90E80EADA5B4E0187A5E231F863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2728e7dfd7d47d7ba0022796963dd42f14cd4d3659db7c92d8afe9e93c9d4736
MD5 9cee2346cff2be59f768d5df70751cf5
SHA1 2a1a5bd0717105cd6873ccab33e5a80f40b30251
SHA512 0d405d9e475f2c4982fb6c2f2c3dc44b573bf6dab3bcd17873a8fa94b20e2bd13da2ed3b81a0276887a537f6764eb8c993c37de21fa129fdb39dc4dfab6589ae
SSDEEP 768:1l3dBlYyJaCB7Hucys6BRvi82oP4/z6himo6geHsq3:1l3RXg3imOz6ImoneHsq3
TLSH
T1C6F2BF30D865DDB2DCE7A2C9B54637926EF5123395CC5E50DAEA6F0E11837AE031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 309f2c03ed72fa212b72e759ad28090c4700bc186571353e8fcbdfd5da38e4f4
MD5 9c1f1d9433af4d84aad521d1102fd7ea
SHA1 51d89d8415175279102bc569ec7bad539bb27a95
SHA512 be2475fb2b1311ac6a6a2c88f3173dd9a37402b1974dbe8211b313c23f6e59ad61c75ed3f29c55c828fada1eadf189ea1375b3d62c355a14f1fc89c2418dc976
SSDEEP 768:Dl3bBlYyJaCcI7Hucys6BRvi82oP4/z6himo6geHsq3:Dl3rXk3imOz6ImoneHsq3
TLSH
T1A5F2BF30D864DDB2DCE7A2C9B54637926FF51333958C5E54DAEA6F0E118376E031B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bd6259bd6c46ce2f8b671035de3e767d3108af6f21f856572a0b6f87608070f1
MD5 ffbf7944366a38d929414333f6a4cfc0
SHA1 1bfb65a0b014d5f9874850416e153cc7e3c39d25
SHA512 b907184648aef2e5524cd5436d9bbe77e39ca85bcd0402c808b6388eef53a832b16f4ccecefd9c77aeee3f022cd2715e5028f09989b22d3b997f736090b8c4b1
SSDEEP 768:xGrv+4UNbdS323SlYyJab7Hucys6BRvi82oP4/z6himo+/2bwn+h:xGbsbw324P3imOz6ImoA0w+
TLSH
T1DA03C035E4149D73ECE78288B54A7B933FF4522345C91A80E6DE6F0E429BA5E131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25055072-ef72-4de9-903b-40ab80069eea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25055072-ef72-4de9-903b-40ab80069eea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3492_1391823186\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download