66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v1A-m0-eL.svg
Size 3KB
Sample260819-spms2axblf
SHA256 66ba352347bb76d950affb07d51d3dc22a9e1e0e316488fd409ecb337f490e73
MD5 95b7e2e1d8065db4ac2ce8927e95981e
SHA1 9f303ce03119c2588fcbb4f320794622c61045e5
SHA512 88d142db6604e75c03e021e409b771a60808f39568002c877a1bb39f1dcb57f89da8c819bd1a76d8cb929edd7c1405165884108a2abca02f298c6a497219887b
TLSH
T1E871268876F87EEBD7C802570D51D4B84B2F946BD822978DD3CB90E875282AC735D5B0
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5684	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316263012651518"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{C42DCBF1-1A5A-4F0E-B30A-459A125C6FA9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5744	msedge.exe
5744	msedge.exe
5744	msedge.exe
5744	msedge.exe
5744	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5744	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5744	4984	iexplore.exe	89
PID 5744 wrote to memory of 4204	5744	msedge.exe	90
PID 5744 wrote to memory of 5684	5744	msedge.exe	91
PID 5744 wrote to memory of 1064	5744	msedge.exe	92
PID 5744 wrote to memory of 5264	5744	msedge.exe	93
PID 5744 wrote to memory of 1064	5744	msedge.exe	92
PID 5744 wrote to memory of 1064	5744	msedge.exe	92
PID 5744 wrote to memory of 5264	5744	msedge.exe	93
PID 5744 wrote to memory of 816	5744	msedge.exe	95
PID 5744 wrote to memory of 816	5744	msedge.exe	95
PID 5744 wrote to memory of 4412	5744	msedge.exe	96
PID 5744 wrote to memory of 816	5744	msedge.exe	95
PID 5744 wrote to memory of 4412	5744	msedge.exe	96
PID 5744 wrote to memory of 4412	5744	msedge.exe	96
PID 5744 wrote to memory of 5548	5744	msedge.exe	97
PID 5744 wrote to memory of 5548	5744	msedge.exe	97
PID 5744 wrote to memory of 4136	5744	msedge.exe	98
PID 5744 wrote to memory of 5548	5744	msedge.exe	97
PID 5744 wrote to memory of 4136	5744	msedge.exe	98
PID 5744 wrote to memory of 4136	5744	msedge.exe	98
PID 5744 wrote to memory of 4680	5744	msedge.exe	99
PID 5744 wrote to memory of 4680	5744	msedge.exe	99
PID 5744 wrote to memory of 6128	5744	msedge.exe	101
PID 5744 wrote to memory of 6128	5744	msedge.exe	101
PID 5744 wrote to memory of 1188	5744	msedge.exe	102
PID 5744 wrote to memory of 1188	5744	msedge.exe	102
PID 5744 wrote to memory of 4636	5744	msedge.exe	104
PID 5744 wrote to memory of 5192	5744	msedge.exe	105
PID 5744 wrote to memory of 5192	5744	msedge.exe	105
PID 5744 wrote to memory of 2808	5744	msedge.exe	108
PID 5744 wrote to memory of 2808	5744	msedge.exe	108
PID 5744 wrote to memory of 4680	5744	msedge.exe	110
PID 5744 wrote to memory of 4520	5744	msedge.exe	111
PID 5744 wrote to memory of 1992	5744	msedge.exe	112
PID 5744 wrote to memory of 1476	5744	msedge.exe	113
PID 5744 wrote to memory of 1476	5744	msedge.exe	113
PID 5744 wrote to memory of 2644	5744	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v1A-m0-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v1A-m0-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa7789c188,0x7ffa7789c194,0x7ffa7789c1a0
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,379863933341543831,18118346470727107096,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,6052193516078843318,11601169916314881421,262144 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,9682435141339666962,16328938733850485570,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,2817835702694871768,14482026704322612425,2097152 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,16900342307573888553,4922755401847407447,2097152 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15320662941956250004,13359061802699356114,2097152 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,8887688546666719287,15433883685505497209,2097152 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11251954250819620517,16112766047933613905,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,7853711343502197251,10837606490142354082,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,13551143099356777927,3581436448842133493,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17699953641904664624,1466189752170885396,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17699953641904664624,1466189752170885396,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15725470416816635163,17064972892377560034,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,11642067756694356691,14567529454879193852,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8956712033366413794,17459547497765164912,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,9119179990851179479,14435082889362519640,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,12319230921767126004,9133465875450233044,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,15272721058503911534,17604613593231274659,524288 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=1172 /prefetch:14
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,7249996056125484669,10230907637927806611,262144 --field-trial-handle=2456,i,6265862322977761725,2938267415837476656,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

6051fd94-6283-4534-99bf-fc19058ab9d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6051fd94-6283-4534-99bf-fc19058ab9d0.tmp
Size 11KB
SHA256 22bb5c85f27738f2d3055d88aacf7503d1f4960efc2babc1471a04342916dd6b
MD5 f5b7759025330eb7fd4d90771eb05d5f
SHA1 7214a11215fe4bba7eb404812e8d7e1b2fc12e5f
SHA512 ddf7884b5f49af6cf3ca56c4b7981a8ce13b0ffcdc529c58348f73456b5353ba0333cf1d426fe905eaafc56024b406eab4cf9f7ac5ea466f53838f0f38b207df
SSDEEP 192:sxRARJCp/fgsSMprQ57zoA8p44/g6+WNIYn8UchJG4ZIgVfJ:sxRAyp/fgsSMHJ/5IT/vz
TLSH
T1D132A6156E78A83B5CC7E21DFB65BF53D6F95032A0D11E48AAFC8A1C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f1100544052886b8dcc818eb3392a279363b61a1ea9ad5767e368a0991c1c025
MD5 970fa2b71155bf98af36c07a2db66b28
SHA1 2c7c80b87943a142f4cd5e1bfb515b780f35eee3
SHA512 088cb86943013d5e3dd0367acd554d226d18e48c6ce13447c3e6764ca6d5fcf45a469259b7b69e15dbe7ac185163d592d5e8e101be12536ac523b4d6ce07bb32
TLSH
T1ED61515963210EE3EBE5C9F192E0B48831F78C60450BAB3A4293ADF068AAF7851DC517
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5919f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5919f7.TMP
Size 3KB
SHA256 bd54da2e977d91970f86b3eb4fbad35e8d360cbf253280e6da7dda65274fef58
MD5 7c5c22055e09ec00677049ccc56a8cdc
SHA1 fca9b5ce4c1f4d6b98bc3dbcedb351cde2261984
SHA512 41aacdc5112477216c225dcb78a3e734b29f0a7c4d229ad0fb59a17845be2e72107dfde939a93dac593ac19aecc5748df35acc8ea742abf5c4541a963862ddb3
TLSH
T1E461515D63210AE3EBE5C9F196E0B48831F78C60450BAB3A4293ADF06CAAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d2140f62367124f09ea2ce8484398ecec3c0fa225980261d8cfb466afa6dc79b
MD5 f7d655d9dabc9bbf48f38d382ddb0fb3
SHA1 4eea0adea74f13fabdd9c12df89d3c5b0ed88471
SHA512 0409ec5694a18ddd0fd4d2c6528d6fd3816fafbd83f34794c29247f21378403a9bb606a494932a179a97816358d1e15e466d2ed430212ee1c48386c294e13ff9
TLSH
T108418BF7C3F4856E8A0196F4AA186E1FCE2C0915432C7D5A89E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 62079d16d6b3817741a4db2f426f50821628a4dfec659914e51f62564cbb7990
MD5 79f839903fd7fcfae6b24d4e6e1ed50b
SHA1 1f5c1ca19176d8bd6373c5ad11e0bf1758bad8f2
SHA512 923734f9e7ef6ef41c7f8c562d924bd00199b446fb89003912d59116892bb06645b4e3b2215cbd4986296018718bc477e83cafa48d45df3ef28bceb00330fa68
SSDEEP 192:sxRnRJCp/fgs99lZ36zoA8p44/g6+WNIYn8y+hJG4ZIgD3fJ:sxRnyp/fgs99LnJ/5ITRvl
TLSH
T1C842C7156E68A83B5CC7E25DFB65BF53E7F91032A0D11E48AAFC8A1C14E76DD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0ed7b8e2793455daaaacea062c67dd56e7d19537971ca4e9bdf52c19a45a0650
MD5 93a6af7ff6345858a3bdeb745193c40d
SHA1 df8d5a4b1e9b28b370e2f7509dc5e17d5f27cb47
SHA512 b01c371612889f017b70b0229d60bf9eb6cb841eec553b2aa9943b5576bea5e484a9e58d1429cee9198d1db4c0681238114d96a4d3f8911b89ed598a25e07409
SSDEEP 192:sxRnRJCp/fgs9MlZ36zoA8p44/g6+WNIYn8UchJG4ZIgDNfJ:sxRnyp/fgs9MLnJ/5IT/vP
TLSH
T15342B5156E68A83B5CC7E25DFB65BF53D7F91032A0D11E48AAFC8A1C14E76DD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 69dcc71fa299689045fc7f787e8f9cf953598a4cc67e7c4f7ae3f839d54fd0cc
MD5 0e42444cd833d539fd3d096abd91fcfe
SHA1 f3411a1184664b0974691f0c8f25ae901631e751
SHA512 929f595cad57d4b38e84df359a76d67556727cc8215c64151d1c7a01e5a925a75190dd1c929b786ad87c11ea96efdae45e88f784877596e86dd4cdd1f0530d6a
SSDEEP 768:wb8dOg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXvmu46frohnd5l:wb8dOsE7r6Wgouf6Mu1jasvmV6MLX
TLSH
T1DDD2DA7B740DCB7F4F800ADDEC19BE9F6D6802CB96D8C94447FA951C02C6BEA51160DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

580c189b-032f-42b6-af25-b3ec9298db99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\580c189b-032f-42b6-af25-b3ec9298db99.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 16f8207b6f2282e57502d4be78e1d38f02073f96867dee23d528e6a1fd61371b
MD5 d0a767a306f7877a1f233546b089749e
SHA1 730535cdca12d29d250bedc6f32117066a8cd602
SHA512 5efb495ca6fbf7447006d02319d65eb7c3fa358adace36288447bdc5b72f5cb2519c0a492c34f231467eca83fd8082060db3009001b88e0fa3253e55a936b0fe
SSDEEP 768:oFQX3Rwge2iZw5O0335Nzc4ReyIsPEfux:LX39tc44bs8fux
TLSH
T1D0038C76EC64C927BCEA9786F7067686AEF01167C5CCADD4DAD99E1C00871DE070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 288ab1a03081188afe3ba0e90fce8c1118224a8a0fc8b7af83a711fe854f75a2
MD5 10f45157dd93c662d0919e7cb1e27e72
SHA1 a6241e22f63abef56094a649f5356f0ba34f608c
SHA512 146d1513662514738d4762ee35cd92365c3b6d76b464958215ec2180267431be5500ca8009ff23cc7477806b63dddcbc50c965c0788e5681c8f17b686c776e95
SSDEEP 384:nqZZcIl38N2Prw9RU2JDZNfNoXOVSUUHXCDOH+ETRzcoXfK86sfxEZxxsIj4lBEe:Cl3b2rDZIO0335Nzc4ReyIsPEfux
TLSH
T1E1F2BE70AC74DC236CEDE286F60636937EF4612781C81E98D9ED9F1C054769D1B6B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6e54f5935fb8a762ad749d50f308d4869957f602595b291bcc0b3764a1b7fe68
MD5 e61a20e37855aa2fae131590fe469bfb
SHA1 04e4773162e62c1980f49aa2e1cd959c61031149
SHA512 ca62d35f54dbbdd053fe3840e6d437b23f044fe375f917aca00490415528a8d9104878d3df9c8f34ead7bcef06c5eeb010a0a01d13f1f58dbfedaedd85e4d7cd
SSDEEP 768:Drv+4UNbds35hDZIO033zNzc4ReyIs2EeVH1S5D:DbsbS3Qtc44bsLEH1Y
TLSH
T1D703CF32A878CD33ACEAA646B14772933EF8212B81C40E94C9DA5F4C0A471DD175FA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0858f6992c9ab31610a908238021bfc59756618e41e3ecdd00d3396f56f70163
MD5 587114c2ff5f0462451be062f5d537ba
SHA1 1bdf00a8e945c3b67da89fcee3840b823de43b43
SHA512 d1f4f843b037ff3de8f67f2adcbc076694180227234d7f047fee09c02af1dd242365bad4d19d7e0d0febf489ee452647545a36612a07a4c73cb0ffb1144ffe54
SSDEEP 768:urv+4UNbdu35wrDZIO033oNzc4ReyIsPETd:ubsbc3stc44bs8B
TLSH
T15E03AE31AC389D63ACFAA286B10775837FF8216B84C50E94DAE95F4C054B1DE1B5F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 486d9c8a594b0720f80d9362a36c57f27a9e1c8169698220c5fb89ebd4377ee5
MD5 9902660edd75b2313496d89fba3fdb0c
SHA1 3a69fcaa29d30e0b1d3aa54c6e9403539b4cd057
SHA512 00749504927e1528d48ec3be772805223d985de719ae1297f6d0e4ddb0490efce9d5244bdf9360ecfc84e47af3d6ef146599f2fef051a0e7311c4761d88aa6eb
SSDEEP 768:6rv+4UNbds33HDZIO03SNzc4ReyIsXyeVH1S5D:6bsbS35tc44bsiEH1Y
TLSH
T19803CE32A878D977ACE6A786B10775537EF8512B82C81ED0C9DE2F0C464B5DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 708f22e49948410763cf5b66bf58733d703992809aa88d3efec67bafef39f1b0
MD5 41ad66de33af06860dbd1ab72b4f465e
SHA1 4387f71c7ebc87dda9ebb9b63f85a7026af7f2d9
SHA512 f9990d8f88ff69e9821a227cefa8b6825a9198730dec2de4993857ee6bbbcb2f6814473e0eed0125abef4f12ecef1f5d34a7665680542c2197c196c8186d7902
SSDEEP 384:nyZZcIl38N2Krw9RU2JDZNfNoXOVSUUHXCDOH+ETRzcoXfK86sfxEZxxsIj4lBEe:al3A2rDZIO0335Nzc4ReyIsPEfux
TLSH
T1EEF2BE70AC74DC236CEDE286F6063693BEF4602781C81E98D9ED9F1C054769D1B6B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b024ff0f-c149-47e8-b5b4-16a68e7e6564.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b024ff0f-c149-47e8-b5b4-16a68e7e6564.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5744_810882280\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download