034b5d6e09303e16eefde5d43f7ff40d36a26b11a7c2c6754faa9dc628651f91

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260911-it
resource tags

arch:x64arch:x86image:win10v2004-20260911-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
optionals/Optional presets/corona light/screenshot_comparison.html
Size 2KB
Sample260930-nfad5ashnf
SHA256 034b5d6e09303e16eefde5d43f7ff40d36a26b11a7c2c6754faa9dc628651f91
MD5 441a2da471a117515ad1143f142161cb
SHA1 a743dce4117088ed8a693bad44eb7a857ba767d1
SHA512 02ca9300e133db9c43541acb7acf700407839a7c0809d8ba29c6d14d8e0f1f685d4f54f712b25ff0e4ebe36852fb968053a2d7905d2e99ab886148b724e7a3e0
TLSH
T1605174B320135C19345F40BC77E2F28A8121A146E38AB9C4809BF7F79286E83F4A7D56
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{7B0DC9D8-8EFE-4779-9A65-80A892EE24EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1692	848	msedge.exe	86
PID 848 wrote to memory of 4028	848	msedge.exe	87
PID 848 wrote to memory of 4472	848	msedge.exe	89
PID 848 wrote to memory of 4472	848	msedge.exe	89
PID 848 wrote to memory of 4472	848	msedge.exe	89
PID 848 wrote to memory of 4468	848	msedge.exe	90
PID 848 wrote to memory of 4468	848	msedge.exe	90
PID 848 wrote to memory of 468	848	msedge.exe	91
PID 848 wrote to memory of 468	848	msedge.exe	91
PID 848 wrote to memory of 468	848	msedge.exe	91
PID 848 wrote to memory of 3844	848	msedge.exe	92
PID 848 wrote to memory of 3844	848	msedge.exe	92
PID 848 wrote to memory of 3844	848	msedge.exe	92
PID 848 wrote to memory of 3444	848	msedge.exe	93
PID 848 wrote to memory of 3444	848	msedge.exe	93
PID 848 wrote to memory of 3444	848	msedge.exe	93
PID 848 wrote to memory of 3184	848	msedge.exe	94
PID 848 wrote to memory of 3184	848	msedge.exe	94
PID 848 wrote to memory of 3184	848	msedge.exe	94
PID 848 wrote to memory of 4548	848	msedge.exe	98
PID 848 wrote to memory of 2656	848	msedge.exe	99
PID 848 wrote to memory of 4548	848	msedge.exe	98
PID 848 wrote to memory of 2656	848	msedge.exe	99
PID 848 wrote to memory of 4484	848	msedge.exe	102
PID 848 wrote to memory of 4036	848	msedge.exe	110
PID 848 wrote to memory of 4508	848	msedge.exe	111
PID 848 wrote to memory of 2988	848	msedge.exe	112
PID 848 wrote to memory of 4684	848	msedge.exe	121
PID 848 wrote to memory of 4684	848	msedge.exe	121
PID 848 wrote to memory of 4296	848	msedge.exe	122
PID 848 wrote to memory of 4296	848	msedge.exe	122
PID 848 wrote to memory of 2240	848	msedge.exe	124
PID 848 wrote to memory of 2240	848	msedge.exe	124
PID 848 wrote to memory of 4856	848	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\optionals\Optional presets\corona light\screenshot_comparison.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe5147c188,0x7ffe5147c194,0x7ffe5147c1a0
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,17196413703813328749,974292917370487619,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,3701924812964253980,17581176097408260909,262144 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,5982553288793184737,2427166230176677434,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6307156741595361023,297697237219609906,2097152 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7850971304101620623,7726630003112868473,2097152 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,15955245874365431340,19222795530814181,2097152 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,11871945777708415155,2159880133356050938,2097152 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:2
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,15148268868626548165,988509004716952670,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,1620906528206523914,11768130085739616614,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6217032416836304089,17705683900806518844,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6217032416836304089,17705683900806518844,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,16650905237925589208,8717100343725827579,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,14060501817812280761,17843521468956349690,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,15279612011345442609,10847588026262885348,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=it --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,8460753961818729202,16035574977610436080,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,13253694970180942751,12428658617717079639,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,13698757559639558920,15144609758423787204,524288 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,9816794102320125093,3825802657847403556,262144 --field-trial-handle=2316,i,1861452451336487267,10914872231837267974,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d03e527b5c24970d816c285228993181e2b72f901d1001ed34294a512a2f7f03
MD5 7a6a15f41a80f1fca31629c54768192e
SHA1 c240a2afa3a4d178b7703e5cceb0fb9f823a2563
SHA512 c2c7f76b5a53478d3863f52a19361ed2c98aedf3acd4fb6360a4d4a5d9b2d9daf89f50f0b2580d7fede539158cce3b26a6ace0a9c9bb27128f9ab9ad35c088a2
TLSH
T183E026C896C8C3BEE2097447816CB78C83C0BB0E93CC6E9A2708C4857281048F3867E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 60940b4ebe05591b13872252c78857d4f92764df962207554d495d2a6fd150b7
MD5 7e610c4571cdf1187ab0f5092c1c595c
SHA1 bfbbf5f9f65816bf2d1f53ca8d4f66866e6625dc
SHA512 13fc45713db0571f043065755c06c756b8595d5f2752ed9c19e9aa79bc4113509717a960ea6e5c3427f3829bdf5a77be944fc26d857355934e89c9aaf41b9c78
TLSH
T17941F8820275A296E798ED7170C5D683BB34DA70648F6E7205E4C5F8CB4BB507B0FA0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591330.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591330.TMP
Size 2KB
SHA256 a8e481bfd666d0788bd22441a40746150dcb39d0e77c5bfb2abda9aa16490607
MD5 faf6db9f719e61982d6b649065606bb3
SHA1 01ddfd903ef455e87752b7ec853fd2c6f4749e06
SHA512 709e8e14676c545347882b3222ea004411bd95f29f358f263fb13998489a5281320bb3739360cf1c44b378df98c040e3c784d3e84fcb288c223ad9e4d485cb10
TLSH
T18641FA820671A296E798DC7170C4D683BB34DA70648F6E7205E4C5F8CB4BB547B0FA0C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7c868594d94aacf397dab8eeb28083b9054694b94e9a6a31b2489cca5a7ed289
MD5 1fd3031b83677087f0af99e8b6fe3223
SHA1 3fccc1acc397f178cb7b962aa1bac5f44e139335
SHA512 74fa218cd2fdb4f0f927c92ffad48f09ea11655f5d96656b77e9bcc2dbea4c34948593a914757bdb32eacfafedbe72b788049ebff1d461f3f04d369770ed1a1a
TLSH
T1BC319CB6C2D8477E881212F49B256E2ACE5D054A422C3C5A8DF4FF1F63E24B0E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 47dc28e589fdafda6490bbba7dc0bb1db63ac77486286ababb019615a720b079
MD5 7142a94d2781acd4e1ddb4208a65202b
SHA1 234ef3cbb19a7b3b4513c377cfe72bef4ad4596c
SHA512 4cb2f9a3db0b12b891fde3845f73572c0a8defb77f3d6d155fb60f7fdbb7b0c2332fd0769b9ea53d26fbf2269c93f8c96eb213cfbce59007750dd7ca33fb4a6c
SSDEEP 192:sxZA7LW6L/fJsNs7sIupdMHW6+WNGYrboLIgrJ:sxZWqm/fJsSYGHbGV9
TLSH
T13C1296526E28A97B8CC7D219BB15BF53E6F9503291D51E48BAFCC61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 63978406c99a317ec773255663944237adda3ab10f0425d5b78ad2e9cb59fbda
MD5 b7238460ea1f0943ca95b9ef84663eef
SHA1 52790fa401bbfe4beaf2959e1e6ca6ebd17f9f55
SHA512 3afb1ee94dc0762de4fe552f9cd4509313289146b9ae906623862393fc67a7f3d709cc08a9a11d805ab3d6595c80e4349eb153b6ae6e8bec8babd5979b0eb4cc
SSDEEP 192:sxZA7LW6L/fJs01s7sIupHMHW6+WNGYrioLIg59MJ:sxZWqm/fJspYsHbGeg
TLSH
T14922A7526E68A97B8CC7D20DBB15BF53E6F9503291951E48BAFCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b33aad627f4a14992f0d2af568c6cacb3d55f837a0f07d74e132302d55786232
MD5 a712083b329e4e022467c0b9bd74668a
SHA1 134ebc3412a3380f7b7c841411441f6917a2d415
SHA512 8dd985a010cc1863a084ff313c30c3e07224d1eeb1b225ae90e1bf7c0cce4769f19016f90d445c8b0bba613badb1b5674666d2f02b05c3b1c1161a67f6e2e2d6
SSDEEP 192:sxZA7LW6L/fJs01s7sIupdMHW6+WNGYrIoLIg59MJ:sxZWqm/fJspYGHbG0g
TLSH
T10022A7526E68A97B8CC7E209BB15BF53E6F9503291951E48BAFCC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e164ad971f56e31e9f602350aa65af863c6693c501a97445a0b8c827629ca770
MD5 46079dca4af7e0caf70b5e73c56516c7
SHA1 262366439fe301671324d51bc879fba587af57dd
SHA512 d6cd4bafac8f2f75bdb560e2f4f09f37a8d00bc9d5759fabd745573a8185287f0941377495d2929f12fbe7c5bc6ba47ecc159ca25f0b6ae27fd8c59638dfb41e
SSDEEP 192:sxZA7LW6L/fJs8s7sIupdMHW6+WNGYrboLIg59mJ:sxZWqm/fJstYGHbGVi
TLSH
T13112A5526E28A97B8CCBD219BB15BF53E6F9503291D51E48AAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c1073704c3153986db3f3fba6461e507a090cf2fd5be21ef9422667b6da7c13c
MD5 0cea625c59d9ee608427c84ab9507bde
SHA1 40147a45445c5708dc4d366a70e798cf922dc957
SHA512 79547044170d1cc06872022977a42a5a0ceed6410853c0b2c143ca6cb527199a81278e41c2a9ad92d24522786a369133082ccfb9fabbb226aa965108ef1859b6
SSDEEP 768:Ojy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TberoRCE:Ojy4J/DWvbtBhu1jajiLm0b1gE
TLSH
T176C2FA3B684CCA7E4FC00A9DED5E6FD73E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 f429961ace041200b0a6f4a3fb8e693fbc03721c6ac63bcc34c17d3e99ae0e7a
MD5 50e5faaa44d5d76aff26a151a18c4cc3
SHA1 0c539a4106cf75f34c81db5d295df51f35566354
SHA512 9ed9e069af12cb64ad0e1dac13912dfa8ca78741416e1c71d48cf8726b6cdd17a91a63ba9a642fa0bca5e1b77bed00e60465d75df1f4ab83dabe673c54bbb3a0
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ul:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAk
TLSH
T17EA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aef3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aef3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 248c4a8cb110206bbf7224fa73a4b6a41a065c9f99a1b58ecc9a8689f1b2e5e9
MD5 7e35245750737daf45c0ad7a28dca5cf
SHA1 6f19ee96d68f4654d228c4ab01883d6b15289ae3
SHA512 5e7a5769a02e2422017487d0fdb12d23bab3f79f70a6909ff0642a24d4576c6edbfe37429431fc8649ae6822c4719b9c7fdc4c61f9a4823b0e280fc793c7f733
SSDEEP 384:dZcIhsN1zF4ZYnbHX58ED8qJTqX+uJERtgOIwZOym+oN:FhHYjaey+uJSXsmq
TLSH
T101828C3298BC6D7B58F7E145F18622039FF9802BD6C96FA4D5FC6B2C019A1A5030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9883a2997d85f165936c92455debe4cc1367e7cd7b8d4dc5f118f452275c3e7
MD5 8407b779a14ca155e7ed751dd92617b4
SHA1 fefe2a5662a46bd4d552624709b1d29270195771
SHA512 19d2a56e1c264989f7c5a2d8a082ef46de98d165be1f4f01a3e69a6631f1a48eda1790f6bf257c0e0782bb7ce2a9d0c69ff2ee222d255a5e96d59e8ad642872c
SSDEEP 192:1ONg6wlDgQmiUy1dW4X58gZTjzorqJTubDl5+U6:1ONg6kg4W4X58ED8qJTiAU6
TLSH
T1A002F835F9B8BC6B8EF3AE09F48627139FE5102BE5952F54DAE81B2D00C725C1306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6bbc7c0edb2b9736dbaaebd3c5b577af33742e0d948265a70b9cd6977fd8848d
MD5 1cb559793a9d4b65125a4d8316b1423b
SHA1 6737ee057b0b75b81353ab1ea75f62d640636d30
SHA512 228399c1723f3cb257acc32ff8308de551a1831f8a29419b8a2f887e8cec6c2dfaa53184b360265a2af1a9d81f3db5519bab01c182d7aa9b4a2de5f296d74136
SSDEEP 384:5ZcIhsN12F4ZYnbHX58ED8qJTqX+uJERtgOIwZOym+oN:RhcYjaey+uJSXsmq
TLSH
T180828C3298BC5D7B58F7E145F18622039FF9802BD6C96FA4D6FC6B2C019A2A5030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 8ffe1bc6d7d928e46414cdfa1a53317617ceaac7ed1897374aba873dc5c92325
MD5 64cfa202815b99670e8893451f7b581b
SHA1 053ec165e84da7d9c96030939db447e9e4daafc5
SHA512 2a57685f30121deb67ab448f6735a82ffed4bd25a87736b11f675f4d7b250c7f2bcbd8dfe6c79e27a57e29c8124002c3c50748d55c16277fe9fe0f30c38c3858
SSDEEP 384:6TFiZcIkzsNP8TUNTUlIl2F4ZYnbHX58ED8qJTqX+uKERtgOIwZOym+oN:CFQYKwgpYjaey+uKSXsmq
TLSH
T14BA27C7388A89D7FADF7A644F64A22039FF54067C5C5ABA4E7EC5A1C019B1E8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4355ca42e38f8adf988e89283b949a87afdb7a2352f8cd43358c5b9978532b47
MD5 39ff4c1c1205a8706584ce62dac23809
SHA1 4150dbcac00d7e9de7a0bc054cd2ce742e9131ff
SHA512 dff12ce120b49ca514a49d9b25b203b0cd9f8e89bfe8807f04cf88c893711b105c797ee58a4f5df698830bb866afb233a721d9f37f97cfa4c08985eb664f6fa1
SSDEEP 192:1ONY6wlDIQmiUyFd54X58gZTjzorqJTuTXLSuave0qORU6:1ONY6koC54X58ED8qJTqX+utERU6
TLSH
T1C7121936E5B8AC2B4DE2A585F08731139FF54117DA896FA4D6EC2B2C01DF26C534AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91a50f02-a953-4a4e-9adb-1cd82e9ef9eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\91a50f02-a953-4a4e-9adb-1cd82e9ef9eb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 34fe12529e2e766ce8426113af3ab50a5a9d27d5c8d38d2060eb831ee51e59e6
MD5 632797112b02ad8725db2f1977705075
SHA1 6423a1d31888a4b6c5cbb5c1448df1fd1e5697a6
SHA512 c811496f31f4e652b849a7897043293ed787d74aa1aaf7e06248d39a0531a464b31672e6b97f8b3f0a50704c1cf4be1ea9bd6f47be6c9c55ef977eb02cad6c9c
TLSH
T150410658A6ED1148B3B77E4A9BF6A86D497ABC772E0BD49D00120D4E0A63F40C872737
MD5 SHA1 SHA512 TLSH

Submit Download