dafd7d97d8675bb8ea10eede4680abba88a04c54242a3333a291d66dc91c6e27

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wp-content/images/icon/icon-populer.svg
Size 55KB
Sample260910-apb3escj6v
SHA256 dafd7d97d8675bb8ea10eede4680abba88a04c54242a3333a291d66dc91c6e27
MD5 f8f5f25769046146ae42b17a41c0a16a
SHA1 80e7bba523210c58296f8de4a6fa6a22e913382f
SHA512 fbc4ffe351d868e0bc7742724578a558932d9f17c423039657c3150f3adae2e0c5f2dcc3559e94e5d4349e24e8cab31e708cfd982b5ee5419455db9802ad9b87
SSDEEP 1536:JWAHKFFqtSQd1JZjfknvKi05k1QnwqR1FmRQv+qP:JWAyYtS21JVfWXLi1IQvNP
TLSH
T1E743F1423F407F7C4976D289916CD15FEC26A88F6580AB5F7EF38895B27E6080CA50AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334734397888851"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{655B5AD1-B54E-4382-8EDE-D312B52F42DF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3756	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3756	2532	iexplore.exe	89
PID 3756 wrote to memory of 1860	3756	msedge.exe	90
PID 3756 wrote to memory of 2176	3756	msedge.exe	92
PID 3756 wrote to memory of 1060	3756	msedge.exe	93
PID 3756 wrote to memory of 2176	3756	msedge.exe	92
PID 3756 wrote to memory of 2176	3756	msedge.exe	92
PID 3756 wrote to memory of 1868	3756	msedge.exe	94
PID 3756 wrote to memory of 1868	3756	msedge.exe	94
PID 3756 wrote to memory of 3336	3756	msedge.exe	95
PID 3756 wrote to memory of 3336	3756	msedge.exe	95
PID 3756 wrote to memory of 3336	3756	msedge.exe	95
PID 3756 wrote to memory of 5748	3756	msedge.exe	96
PID 3756 wrote to memory of 5748	3756	msedge.exe	96
PID 3756 wrote to memory of 5748	3756	msedge.exe	96
PID 3756 wrote to memory of 3320	3756	msedge.exe	97
PID 3756 wrote to memory of 1428	3756	msedge.exe	98
PID 3756 wrote to memory of 3320	3756	msedge.exe	97
PID 3756 wrote to memory of 3320	3756	msedge.exe	97
PID 3756 wrote to memory of 1428	3756	msedge.exe	98
PID 3756 wrote to memory of 1428	3756	msedge.exe	98
PID 3756 wrote to memory of 4684	3756	msedge.exe	99
PID 3756 wrote to memory of 4684	3756	msedge.exe	99
PID 3756 wrote to memory of 1672	3756	msedge.exe	101
PID 3756 wrote to memory of 1672	3756	msedge.exe	101
PID 3756 wrote to memory of 1776	3756	msedge.exe	102
PID 3756 wrote to memory of 1776	3756	msedge.exe	102
PID 3756 wrote to memory of 2876	3756	msedge.exe	104
PID 3756 wrote to memory of 4560	3756	msedge.exe	108
PID 3756 wrote to memory of 4944	3756	msedge.exe	109
PID 3756 wrote to memory of 4296	3756	msedge.exe	110
PID 3756 wrote to memory of 2032	3756	msedge.exe	111
PID 3756 wrote to memory of 2032	3756	msedge.exe	111
PID 3756 wrote to memory of 5648	3756	msedge.exe	113
PID 3756 wrote to memory of 5648	3756	msedge.exe	113
PID 3756 wrote to memory of 4392	3756	msedge.exe	114
PID 3756 wrote to memory of 4392	3756	msedge.exe	114
PID 3756 wrote to memory of 1520	3756	msedge.exe	117

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\wp-content\images\icon\icon-populer.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/wp-content/images/icon/icon-populer.svg"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffb55ec188,0x7fffb55ec194,0x7fffb55ec1a0
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,14874450872762474124,6829061658901359119,262144 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,14574412735558912381,10705226237776197074,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,18337973311326462170,17906326582694633214,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,13594402379882239412,2853603218128896555,2097152 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,12001716238486961844,10332646891796915407,2097152 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3229422098302932210,8490982865827641459,2097152 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,8539035563672761504,14870877140324487457,2097152 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,18189029494380874894,7687760823653307802,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,1019843704265608161,15965389113499088798,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5908070940191620065,14259921980704300173,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17464848984293161355,9081129376306888809,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17464848984293161355,9081129376306888809,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,4199757510879682180,44661794294151944,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12084713605087527559,16124473984835185919,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,1280599741765055489,337239767616339895,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16521693454612765311,5304724935814636429,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,11321637658067392614,13939285657577462795,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,7150192236902808339,18102096919603819969,524288 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,11596941549738248565,14072520728820666748,262144 --field-trial-handle=2352,i,13005733150357928299,11189403472922964202,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f50dcd434676d7c58c62dcba17ea594a5f0d121eee758af529db23534c0b9eda
MD5 4d1fa1adceb41081a59409896f7f3828
SHA1 e4edc1312340b2eac97efd5164e848b95cb84fa9
SHA512 e77bcc2d1bd8f10fde4a001e239993690410e5bc792dab9383b6e67b9f39f158b62394aa3b6064dbf5efde921b71bf6475db73cc863c6a1c77a074501220e022
TLSH
T1B7412FD5472729E1F39676B62CFBAE68F2B0985D120F6FF4D000E2B44AFBB5019B1850
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e02dc5dd5525d7983b4353d3cd0624e8f7a5784f2bd43fb85d0d6c8cf0630307
MD5 95c18c05574083c11e152aa367ab51a1
SHA1 55bef937c3bfe6533414a7f6878c16bb351f3e11
SHA512 e23b6bcffb24cafb1648147e85e4ca1d7f592c1d9df92aed5d9c7ce5b307ae805d541302002ab25ddabe249198f758804eecd76e53e9b5a5eff8b17777a8f66a
TLSH
T1CA41A1F383F4956E8A0196F0AB14AF1FCE1D0511431C7D5AC5E4AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a1d5c5c45161d6d81f372c4424d60a64abb2d37d279752e5f86c694923fe0af1
MD5 91fd2cad9c6d8906128dd5102b09f064
SHA1 48de82ea026ac329d9c1c4f7eae06d9b7b8cece5
SHA512 e19e2aeca62f808862386442e0f1218e00b41f664a15f3073fbff151b744dbb80a2df3916577b1ca54894ba97ede19c56742bc652d43270d395ab3949c07014b
TLSH
T11D41A0F383F4866E890196F0AB18AF1FCE1D0911432C7D5AC9E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a69e78b37ac1b9d6fbc2d02df9ef904e50db55a865cc463125e7f18db67c4827
MD5 084bdd6f28302f9af85e920f7e10d0e5
SHA1 db516641dd4f3f936a7aff5d4906f18ba3503997
SHA512 18d52e0a109e7611372a252c0c30ffd3bd53224a193c4f7e63227ded8d2155336e7a0381ed2a686ab87f4695262f7234c2b24f72c550c7b7ca2f194d6e34e305
SSDEEP 192:sxRTRECG/f7s3Hm2Sm7aYPzoD8p4s/g6+WNIY3B2AmGRIgVRJ:sxRTpG/f7s32kB/5IAzN
TLSH
T19F32C9166E28A93B8CCBD31DBA65BF53D6F9513261D12E48F6FC8A1C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dfdb64b9752e566862ba67a8767254ee0eed55ac1056124a4123b53542c13346
MD5 4aa5868a3cbf8d2679a1afe28874291f
SHA1 21d265f7da2ea5ef0ca9d4e03f5232b3010e15c4
SHA512 6ece5f749ae0dba7f8f261cf8156a85ae29e92024b5ffa3bac5031c88ce2288cd3a8a84c3158d213b75ce58fe75594a3002fb5e4085726d5a30351ec47f9d6c5
SSDEEP 192:sxRsRECG/f7swHm2Sm7aYPzoD8p4s/g6+WNIY3B2AmGRIgDCRJ:sxRspG/f7sw2kB/5IAzw
TLSH
T17842C916AD28A93B8CCBD31DBA65BF53D6F9513261D02E48B6FC8A1C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 30ac6590f90b37e7ed695a27328e3d08f7683051f275257a234778ab9b6a6910
MD5 feaa8bc0eeb5ca23dc612c20694ff24e
SHA1 ee1cfe5627976e42960b5f6debd5c3b297ca63e0
SHA512 38385db05df7d8ae0d12e346adedb8a564f4800fe6793fee421e57ee7838f4fcc9c8c24bd8f24da9c8e89149afa6408aecf22657093569e047d2a04516e6d2bd
SSDEEP 192:sxRsRECG/f7shYZEsqcPzoD8pes/g6+WNIY3s2CGRIgDYRJ:sxRspG/f7shmPqSb/5Iaa
TLSH
T1DB42C9166D28693B8CCBD31DBB557F53E2F9513260942E48F6FC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6b3aae094119a17baf5c46e9d2b34a996a91eb8896abb7fbf305ad4494b99425
MD5 76ae60c061d8c46005be6ab020c9caf0
SHA1 ca48fa84206a56eef33b948f37e9c35284b7add2
SHA512 c6bd78e0c7cbd17d95331b53f5b6bb52fd99071c999d58603d0ab494848a1bf14abe90dabcc567375031394219b2e4c2cc6ab76b4dcfad32704c8537833406d5
SSDEEP 192:sxRsRECG/f7shHm2Sm7aYPzoD8p4s/g6+WNIY3s2mGRIgDYRJ:sxRspG/f7sh2kB/5ICa
TLSH
T18442B816AD28A93B9CCBD319BA55BF53E2F9513261D12E48B6FC8B1C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a19ca5f3c1ff191394e8da09fb404aa4e069daa8610b10f3d86a8fdb55db65b2
MD5 fe19dde44b61370bdada0f8e7ae75367
SHA1 c47bce0ce8963a3bdcb0826b66e5f759717dec04
SHA512 ed4eff3f442c4faa26c2c2bc7b93882e6f8f1c8a717ea9f678365731c7587420a7d3b75f3ced814b671a5950de4e49c570d002fc7b6810f111016b22b0546cca
SSDEEP 768:GTEbCo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKMWciroK2iu:GTEbCUE7lkWg0CfKsu1jaDFc5KZu
TLSH
T1D2C2EA7B740CCB7E4F804ADDA819BF9B6D6802CB9698CD8047FE951C02C6BFE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e61375ed792a3f413d690352a25a4fd5ec86686b07b5c7b08b8616e78ad1c279
MD5 f185cdf7059baa40e506f6a8ca9e043f
SHA1 c8354534a943e85b298a97ba66920ba05dd8ad4f
SHA512 84bad03faa42a3b7de37fbb622abe10d5a2ca1d023a59974801147a3ad9697bb3ecf5d9f1f0e9cdfbf31994b03218299845fc96ea74ffd6118cb9643c42b6862
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHwBUAyeSIWWLbgIIK4Ng6Icoob6AFH8dIR:C1i7PF/DWrwfX9mgpct1o7zsHwBUAye0
TLSH
T110910415313B1340393DBA4C91FA942FA6C170A73018E56B3BAA159A5F26F038CFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 84b31fcb7d14ba2fb6aaee1ca744881d5a9e6b520a42ecccca8c5d811b00f702
MD5 190c379312557961ed678d83e9fba098
SHA1 c0920e6620d076a183ca4796320789f157ac5fe5
SHA512 9a1901365c0542ad4386cb8b047c6b296e23df026e9b8ee52b35fd1d46cf8c48fa2c8ded3aeba88608a79b23f994d6bdefe30970b1c64e9574248f33a615e789
SSDEEP 768:aFQY3lwgO9ebv+fZOZf/df6cvShCQRoD184pE1W:BY3yk+fOfFfBvSEWB1W
TLSH
T164F29EB1DC6099B3DDFA9785BA0A7703FEF45163C5C89684DACD4E0D41832AE131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 43978f9567bda8c6f4cc4dd4b5d03f6583dff3bab38361c4332ff74c35ce0eed
MD5 a47a38e6ce120c57507cac0a89787c60
SHA1 ffe559a147db46130b13809fd1a4ed8eba6cb370
SHA512 e725107291468a01e52f0adcde56cecf42eeffad7ccedbf2f91e76b110ba7c01c230e5d0ca22ee7cffd815290a5db732693cf40a0bf1621b7de399d9b7527db1
SSDEEP 768:Rrv+4UNbd43Yhkc+wfZOZf/avShCQt22bwWV:RbsbO3YIwfOfivSa0wO
TLSH
T15503DF32E86499339EEB82487646BB53BEB86273C8C54784D6CD0B0D419369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 82441e6cc1dad894261c27ddf423d8f339d0b4773237b4a6760b035456560c0a
MD5 d81863bf684755ae59d813b8d49f63f4
SHA1 62c445e1127ccdad1b2af895df8363c798ff45c8
SHA512 ee7df1b1883d84d54db3e675923c7a4ab0a0a99cf9601386e198dc4a9657e8723d9ccb53d7fa3781637ba376584802ec5f8c973a3efe00a657ea41e02f93d972
SSDEEP 768:8K3B9ec+wfZOZf/df6wvShCQRoD184pE1W:8K3BCwfOfFfPvSEWB1W
TLSH
T196F2AFB0D8656DB39DFA9645AA067B03BEE49223C5CC5644CDDD4F0D41837AE231BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 449f9f511515e5bffecb779f780c9ba524dcfbc21e1f05a7cbbb43b32cdf2397
MD5 5439f4cedfbba2e407e551706cffab05
SHA1 07bce6e8fbc623e9cd956e538f0f5049c25420eb
SHA512 28b44aa42259b54158799c2db43f9c929c724e040731f9c0a40631d574cf90ebdfef43a7e76a638f648b263903dd42b7a67fe2edf328544b8d4d841cdb240bee
SSDEEP 768:jrv+4UNbd433Ac+wfZOZf/df6FvShCQso2bwWV:jbsbO3awfOfFfQvSv0wO
TLSH
T1B403CE71E97469739EF786487606BF13BFB89263C1C94684CACD0B0D41936AE231BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 88e01ec1d4ccbd52b5995700ba18cae6ee310f5d7bfd4fe392787447ed55dab3
MD5 559d6510e37ac12800924343d58899d5
SHA1 4f9cb04385d85cbf3c5a376c011612c22e9dad37
SHA512 86f2619fdb3925e3c7a7fba846891b3c4633a8ed9173bcdb591bedd15672c9726e528215ea35a45532db2c56347b812425f93cd98818535d5ae749ce032cf524
SSDEEP 768:grv+4UNbdp3y9ec+wfZOZf/df6wvShCQRoD184pER:gbsbb3yCwfOfFfPvSEWBR
TLSH
T1FB03BF70E87469739EF69644B607BB13BFF8616385C85694CADD4F0D42C32AE231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b945fa5f506e5c35fc5f4885318fa126c86723767044567c32dd7c0688e7e109
MD5 b4ab53eeec23ba0ad360c1714b42657e
SHA1 6bac02ce08f4fe8074e9e3e376c3a0d240a9e1d6
SHA512 bb31ca1c1b66bab71d13541648c0621947f9e659296aea082389f8e81a681a2a35b2ff9fdd1171e55bb666eb642251525cdab6f3e214d8166e3969306a1d3f71
SSDEEP 768:SK309ec+wfZOZf/df6wvShCQRoD184pE1W:SK30CwfOfFfPvSEWB1W
TLSH
T1B9F2AEB0D8616DB39DEA9649BA067B03BEE49223C5CC5644C9DD4F0D41C37AE231BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a3c7fe0-7614-40e9-9281-0afa2491903a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0a3c7fe0-7614-40e9-9281-0afa2491903a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3756_1594072336\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download