61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
small_svg/small1-v17Q-m3-eL.svg
Size 51KB
Sample260820-ecs8dsek71
SHA256 61b14c1baaf839f23597223d597e5d03ea484af80904088a830defaef0973c7e
MD5 fc198985be568c9448dca602f675d2a3
SHA1 acbab1f92a29f89b0c5551fa1c0437ac00739166
SHA512 cae28fd45619470e736d8cbf3586ace8188529cef1810bc1ba52167d16598313952df7669561a535411372356128239006cc9e323d1d9dc0220c1398d77395e4
SSDEEP 384:cmB+3n8fSEBJc1K04m3VQvtvOXmcInOD4WhU62qlOcM933g2G44AJ8pnoSfWcfGY:cNelTKpozCfF
TLSH
T1283380A637F47C9B8BCC034F5D02EC6C45AF94B78498668C9BD790E8A548368F7EC560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6036	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316712987130245"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{7D34A280-5C45-40B7-9C5F-E16B5E4CF410}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3028	2412	iexplore.exe	89
PID 3028 wrote to memory of 4408	3028	msedge.exe	90
PID 3028 wrote to memory of 6024	3028	msedge.exe	91
PID 3028 wrote to memory of 6036	3028	msedge.exe	92
PID 3028 wrote to memory of 6024	3028	msedge.exe	91
PID 3028 wrote to memory of 6024	3028	msedge.exe	91
PID 3028 wrote to memory of 5988	3028	msedge.exe	93
PID 3028 wrote to memory of 5988	3028	msedge.exe	93
PID 3028 wrote to memory of 1608	3028	msedge.exe	94
PID 3028 wrote to memory of 1608	3028	msedge.exe	94
PID 3028 wrote to memory of 1608	3028	msedge.exe	94
PID 3028 wrote to memory of 3400	3028	msedge.exe	95
PID 3028 wrote to memory of 3400	3028	msedge.exe	95
PID 3028 wrote to memory of 3400	3028	msedge.exe	95
PID 3028 wrote to memory of 1488	3028	msedge.exe	96
PID 3028 wrote to memory of 1488	3028	msedge.exe	96
PID 3028 wrote to memory of 1488	3028	msedge.exe	96
PID 3028 wrote to memory of 5824	3028	msedge.exe	97
PID 3028 wrote to memory of 5824	3028	msedge.exe	97
PID 3028 wrote to memory of 5824	3028	msedge.exe	97
PID 3028 wrote to memory of 5652	3028	msedge.exe	100
PID 3028 wrote to memory of 5652	3028	msedge.exe	100
PID 3028 wrote to memory of 3772	3028	msedge.exe	101
PID 3028 wrote to memory of 3772	3028	msedge.exe	101
PID 3028 wrote to memory of 2976	3028	msedge.exe	102
PID 3028 wrote to memory of 2976	3028	msedge.exe	102
PID 3028 wrote to memory of 3220	3028	msedge.exe	104
PID 3028 wrote to memory of 3656	3028	msedge.exe	105
PID 3028 wrote to memory of 3656	3028	msedge.exe	105
PID 3028 wrote to memory of 4680	3028	msedge.exe	108
PID 3028 wrote to memory of 4680	3028	msedge.exe	108
PID 3028 wrote to memory of 1100	3028	msedge.exe	110
PID 3028 wrote to memory of 1200	3028	msedge.exe	111
PID 3028 wrote to memory of 4328	3028	msedge.exe	112
PID 3028 wrote to memory of 5848	3028	msedge.exe	113
PID 3028 wrote to memory of 5848	3028	msedge.exe	113
PID 3028 wrote to memory of 5824	3028	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\small_svg\small1-v17Q-m3-eL.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/small_svg/small1-v17Q-m3-eL.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a0
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14752809817375231750,13867704266192200112,262144 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,11076281557557437444,5430272412509299881,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,2119998054952745417,13303038332679962082,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,9467821125021963253,16222081322368353977,2097152 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,13437926541765575000,4526450184149270298,2097152 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,11493927773826257253,14005907657082294319,2097152 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,1462576799336007482,13511322037072331078,2097152 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:9
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,1197087829579352649,8536312921280923770,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6424325587504037419,11981230217707585062,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,18101631964704040430,13405213009198913801,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14947609702482438928,1989143204319534281,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14947609702482438928,1989143204319534281,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,1720725577611636592,7122447035343996999,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,2324469054454307792,424084366706345257,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,8019286416758221151,12602930992467466675,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,10775431581243974767,2898175347562402789,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,5747218191031342196,5549811420234739518,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,907983626104825273,10710000315111611704,524288 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:14
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,17369375160976808998,10556587902045172293,262144 --field-trial-handle=2412,i,9187538613472363022,7900129259763886472,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

1364d06e-ce77-48f1-bf42-58bec62685ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1364d06e-ce77-48f1-bf42-58bec62685ef.tmp
Size 14KB
SHA256 c347ae28394cc5bce01ad5c4a511a6b1d70d9f69f285d44b76455f22091e6716
MD5 c5b3beef1e8f973a361b0318de482e33
SHA1 45b646966000802f14533d1cc3acb2b2cb3c2311
SHA512 749a1bcfd7893fee5f23b78d75602ef40f04fe3ef994d4e019deefcb061d067b4647284b984181e7f8094187351d4c7cc21c7b9111e657ae5ef91774430eb917
SSDEEP 192:sxRjR3yM/jK1Ml8wCQ/fhsxMclZTMzoA8p4ly/g6+WNIYn8UshXGMIgVwJ:sxRjd8Q/fhsGcLT9gy/5ITfBO
TLSH
T17B62D815AA34A977CCDBD20DFA557F53D7F81523A2901E44AAFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0595d669c8dd6e0b436a1a3b5cb2d0749af57307f67ae69b7e93e5d13626c930
MD5 7fd538447aceab455565bd42c7cd804c
SHA1 0ab4da94baee0a4779f3ac1d0f6dc2856bf838b7
SHA512 c0f3a5bc6d0a91aaf971f4628146cbc7a13243bd5d8fcacbf55d4aa96af82bf06a9061f2ddff906b37c96c4fc162bd6b91bbe32f329968a4f5ac895fd76c23a6
TLSH
T1B161FD5593611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597fc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597fc5.TMP
Size 3KB
SHA256 487acf91b9bd66c2befb5d1f3798c3ff992151fd3fd5f837a4cbbe64800c94a4
MD5 3e5b45568bcdcfbdd6cc1a7be5ac3b93
SHA1 1804b131e092e448a9c7cf04478e707040c8869e
SHA512 c61814967a67a46c503c2ab2ea89a82dec534b0026a34ce5a857aa0c5da702922aa99cb57e32e24bdc51d7b23f622b950dd99df7f530028db2f6ba7073628643
TLSH
T1AF61FD5493611EF2CBE94AB3F2B06C9833E8C446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a03f2061699dcfcf573e19923056b39d2b30564837f19a164419ce90b988f3f0
MD5 c8c924eda5c4c85bdf65d55fd311ac1c
SHA1 939426d7d78460d3e7c5a4ce62a28003fb53cbdf
SHA512 d92abf1c9a0fa6c8c3ef188820d6b56eafd3807a23e011301f893388f792eaf5b752239acbd1a1ae1b7799c57cc2eb7e187ec6700285a8baba6a92fb29594b12
TLSH
T16241BEF783F8856E8D1156F0AB14AE1BCE2C0911432C7C5AC9E4AF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5aa1fffb16bc13b0658ad7662f3fd4b181ccc208c98cf0ac610c55c4186d72d8
MD5 30a27bec178a4df7122dac7179a2712c
SHA1 bae31fe2b505ae2f9563bcc8d27540e7edaf409e
SHA512 aebb7a9b2bd59c0f9aaa240180e199574f146547893993ecb104a5aff7bd172849e5c6401781198ef2d25ab74e258f685ca5f32f5a6b97c6460135d95a13c94c
SSDEEP 192:sxRAR3yM/jK1Ml8UQ4CQ/fhsaMTlZTMzoA8pely/g6+WNIYn8NOhXGMIgDpwJ:sxRAdq/Q/fhsFTLT9my/5ITiBu
TLSH
T18062D715AA249977CCDBE20DFA557F53D6F81523A1901E44AAFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 54cbb11b56e02697580f6a1ea64f11af471d045a27791a6610a2fd0c271d7869
MD5 adf915bd8dc05debb7fbd3f0d62b2b55
SHA1 479d4fbd184fcb2252e27c91297d94ec3a3b9fb9
SHA512 ec534faed793f32c3434c9c0cf02165ef7d859f1680344c224950de0c6568a73f40523f148d5e586db6be7245bf096d0c39d7cfa229d76a65900b6acbb199ae1
SSDEEP 192:sxRAR3yM/jK1Ml8wCQ/fhsaMclZTMzoA8p4ly/g6+WNIYn8UshXGMIgDbwJ:sxRAd8Q/fhsFcLT9gy/5ITfBk
TLSH
T1D162D715AA34A977CCDBD20DFA557F53D7F81523A1901E44AAFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4840071147231584780f99a1f8c371982ee3e8e3912f9f794c29c789bc5f717e
MD5 1ae6f2120a9a1fd274cff72362654780
SHA1 9f4fd7b682ce8ac2c442f322a1bb59584205e9f5
SHA512 6f85e78f3d14c4579637aa2dd0ee28aa8cbeadb0df96eec8fe84e1fce2801dc6d28066662788ce47a728faeef4be19e7aee3f2616d891812e8d08b93e2fb5b63
SSDEEP 768:wGed2g7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrLOu4YSroSO8W+:wGed2sE7X6WgoufDMu1ja0LOVYJ3+
TLSH
T1CCE2DB7B680CCB7E4F804EDCEC29BE9E6DA801CB5AD88D5447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b3fcaa8c8e8c15efff1df7511633d29d22579b92fc2a3d2b401ecdf924e60b81
MD5 fdfce0552c91311d359b07d5b4966b74
SHA1 199cf3c6b91c412f80bc6566c3a4184f65bd8438
SHA512 fc5b53a3c813cb391c5ead69d39084ba357b5509d10f90009c26001d109b366069bb83f9faa9f075928acba8f13fecf14e8e0dc4bdf70db70cdd9839128eba5b
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHklQUuSW0Wyf/gc0K4xgW0cUUfOrBCKqoD:CeTieYgQxAl+eODgc1W+9M+XHklQUuSL
TLSH
T13A91741532BA17503CBEBA8C80A69C6B62D574A23114F42B37E901E50F67E52CDFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ab0149fd7d6ba8821327a9e46d18e8bf29b1fa26ed92970a29538d232347a934
MD5 09f03029dbe7f2b68623b774e2bec6c4
SHA1 40a0e2ec177c2e8cabd1f446ee957296962895dd
SHA512 eeea1866d98d8bf7ede9c916c88c067227999905d516d4452ac6daa9b069c35c8e139656fe35916d0411623755a5d4b0948ddbaf6ee3ffb3d0ab444b37bbf37c
SSDEEP 768:crv+4UNbdJ3+lHfDZIO0CEl8s5Nzc4ReyIsPdfN:cbsbj3+ldi5tc44bs1fN
TLSH
T12A03BE31E8289863ECFAA285F54736937FF4206B85C80E94E9DA5F4C094B5DD271F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2db3ff3a81591cc6deef5771bf1808c4bbe3ab1c77eeaee86d02b58109f6cdce
MD5 b20406e9d4fefa9f06a170e26f360a5e
SHA1 606d039692774a1c4fcb24926fbbdd74f4b0b548
SHA512 960aab98abee91d0d96fc385ad964a7a17e905a905d98342d599e8bf57e8740d3b6ce6e0d50e823d7145bc2f4db3d432f9d824966acfb840fd17e35e2f1db1d2
SSDEEP 768:nrv+4UNbds3B1DZIO0CEl8ssNzc4ReyIs2deVH1S5D:nbsbS3listc44bsiEH1Y
TLSH
T1B803CF32E878C933ACFA6646B44776933EF4216B85880E94D9EA5F0C4A471CD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b77419113f6b482fb02075b4572b2fc7aeeb71ef738cad712ca3678f74bf214c
MD5 bd9f8acb4a50962f1a97d62688c4d2e9
SHA1 6aae8afc4c602bf9b3a191be5648bb5549cf2cf9
SHA512 d2cd19edfd27e7921b5574bdae4739ba7cef827d664b336208850a8ff1dc24a067c64afd4425912de2ea8389dbe9ac372d5827a438086c90113f776be63e9322
SSDEEP 768:6rv+4UNbds3iiDZIO0CEl8dNzc4ReyIsXYeVH1S5D:6bsbS3fDtc44bsoEH1Y
TLSH
T1C003CF32A8689977ACF69785B44B76133EF8612B82C81ED4D5DE2F0C464B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d0668f043403c94c312551a276e8fb77831e0fd456367f27104c4fc4a8b077d4
MD5 8ba0beba1e3cf0a8e0b803849f5df287
SHA1 8a1329b373f6473d3e41c377b1a1667e90b4b103
SHA512 fe9a174a30910fa7baf7a2c498da76e07c4b6a072340289e52a8a6dc4bd0b00d7c97f87cfb0622d1f9e4a7c83dcd133186e29a3544e8740bbee4e519ad3afe4b
SSDEEP 768:xrv+4UNbdJ3W8l2fDZIO0CEl8syNzc4ReyIsPdJ:xbsbj3hlaiytc44bs1J
TLSH
T13F03BF31E8289873ECFAA686B44736837FF4216B85C81E94EADA1F4C09471DD171F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 459208ced5b002669bd541a74605d0451234213b22a698368a7f0bae628404ea
MD5 b5b929713767405a38504ae9fe89ea46
SHA1 0425585f803c2c9f010cde9684c921665adff614
SHA512 8c4985a6f780b9127298dd2ee06923da2d336617755bf151c6d8a1ecd085f33362f739ad43f8fb7fb51c43fbad1796973e011ddc8f5a5ec5e3b9265a5d6a70f4
SSDEEP 384:n4qZcIT38Nt98luqppB2Z/fwxXOVSUUV4EFft4fNeuETRzcoXfK86sfxEZxxsIjN:VT3nlHeZQ5O0CEl8sJNzc4ReyIsPdf1S
TLSH
T164F28C75EC61DC67ACE6A3C6B6067A83BEF4612782CC5DC8D9E95F1C048729E070B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d0209533b0b7c987d3a8bac064ca9f0e839afb234e76a2cdd4783264865941ae
MD5 34607fa6663d516d499fac11bb0a3996
SHA1 36fd838d25ed54af86d5c84af424df2825f443ec
SHA512 c8c36c016b122a375bd613776ca206f96b3f509e9c865c98003fcaf6c760270f41dd0e6901d8e08222028884fd243967640d38a5e0de41512a06cdad4f71846c
SSDEEP 384:n6ZcI638Nt98luqppnJDZNfNoXOVSUUV4EFft4fNe+ETRzcoXfK86sfxEZxxsIjN:463nlHfDZIO0CEl8s5Nzc4ReyIsPdf1S
TLSH
T1F8F2BE70EC658C63ACF9E286F6473692BEF4602B81C81E94E9ED9F1C094769D172B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6b042df-e9a3-44b0-aec9-b0c9db2261c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f6b042df-e9a3-44b0-aec9-b0c9db2261c2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_1917952834\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download