034b5d6e09303e16eefde5d43f7ff40d36a26b11a7c2c6754faa9dc628651f91

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
optionals/Optional presets/corona light/screenshot_comparison.html
Size 2KB
Sample260930-nfad5ashnf
SHA256 034b5d6e09303e16eefde5d43f7ff40d36a26b11a7c2c6754faa9dc628651f91
MD5 441a2da471a117515ad1143f142161cb
SHA1 a743dce4117088ed8a693bad44eb7a857ba767d1
SHA512 02ca9300e133db9c43541acb7acf700407839a7c0809d8ba29c6d14d8e0f1f685d4f54f712b25ff0e4ebe36852fb968053a2d7905d2e99ab886148b724e7a3e0
TLSH
T1605174B320135C19345F40BC77E2F28A8121A146E38AB9C4809BF7F79286E83F4A7D56
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{055F9374-4A06-4034-9AD5-0695917FF60F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5544	msedge.exe
5544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4296	1952	msedge.exe	88
PID 1952 wrote to memory of 3068	1952	msedge.exe	89
PID 1952 wrote to memory of 2696	1952	msedge.exe	90
PID 1952 wrote to memory of 2696	1952	msedge.exe	90
PID 1952 wrote to memory of 4140	1952	msedge.exe	91
PID 1952 wrote to memory of 4140	1952	msedge.exe	91
PID 1952 wrote to memory of 4140	1952	msedge.exe	91
PID 1952 wrote to memory of 5720	1952	msedge.exe	93
PID 1952 wrote to memory of 2424	1952	msedge.exe	94
PID 1952 wrote to memory of 5720	1952	msedge.exe	93
PID 1952 wrote to memory of 5720	1952	msedge.exe	93
PID 1952 wrote to memory of 2424	1952	msedge.exe	94
PID 1952 wrote to memory of 2424	1952	msedge.exe	94
PID 1952 wrote to memory of 2040	1952	msedge.exe	95
PID 1952 wrote to memory of 2040	1952	msedge.exe	95
PID 1952 wrote to memory of 2040	1952	msedge.exe	95
PID 1952 wrote to memory of 6040	1952	msedge.exe	96
PID 1952 wrote to memory of 6040	1952	msedge.exe	96
PID 1952 wrote to memory of 6040	1952	msedge.exe	96
PID 1952 wrote to memory of 3724	1952	msedge.exe	98
PID 1952 wrote to memory of 5772	1952	msedge.exe	99
PID 1952 wrote to memory of 3724	1952	msedge.exe	98
PID 1952 wrote to memory of 5772	1952	msedge.exe	99
PID 1952 wrote to memory of 1228	1952	msedge.exe	101
PID 1952 wrote to memory of 1064	1952	msedge.exe	105
PID 1952 wrote to memory of 5280	1952	msedge.exe	106
PID 1952 wrote to memory of 3416	1952	msedge.exe	107
PID 1952 wrote to memory of 4316	1952	msedge.exe	108
PID 1952 wrote to memory of 4316	1952	msedge.exe	108
PID 1952 wrote to memory of 5544	1952	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\optionals\Optional presets\corona light\screenshot_comparison.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff2ccdc188,0x7fff2ccdc194,0x7fff2ccdc1a0
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,18422673664017071091,8109911098076872144,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,15911376280770823150,9248438873004824835,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,648362643088532369,1693351333159037468,262144 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,13352185616555394806,4765448791523990789,2097152 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,90717943370740669,1308157801811579105,2097152 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,9520204079311706328,6954738782901172082,2097152 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,13797677919011771367,1635621843802181265,2097152 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,2156080736617148372,1440123812176215599,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,16991998195088203794,944847742744850453,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,12454965053781787132,6929048070493088854,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,12454965053781787132,6929048070493088854,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,3619123219291610981,15222682670383117183,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,15041099546302807777,4626162043643355581,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,8442798054528174752,14952986037400934789,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=it --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,8594483031839860195,7745712276840563076,524288 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5644,i,18145288069124818652,13994954106299621934,262144 --field-trial-handle=2408,i,17879405893142061687,1581382862825557904,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b3dd05b2b7dfc63c1d44bedd3ada3775692285f69f8618c2e2b3a172edda1aca
MD5 781e6c7de69b4abb01c81fb88fb94204
SHA1 63f121fd00779966364414602494cf29e60c5077
SHA512 6256e6aa26311184d046c94aea90e70c114ce910bf653eb6c7f9c1da81b8b34686bdb913ae1537b06654cde62ce0517c939bd9f6bfacb0fae81fa1735e756109
TLSH
T12441CB4189703051F7AB47758AE037977AF5CE4E31432E330DA4F9BA5706F3C2664951
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a07c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a07c2.TMP
Size 2KB
SHA256 1b00f87ccc62cb56c8606f3f5ccef59ee4c5993f6b9b8c653ac54d16c93fcf4b
MD5 8aff773bdcd28087c97dd7c60d3c1947
SHA1 9af68f36ddc17acccbb74e2da39f3968b507573a
SHA512 fdc11bd2ec4ae462627d71f74f78a00befa3a222dade9cc88a6f64890225ef7f83f9fe6c81f98ed74b78d0c92612694970e73d5d4cbd48219043f7b267541d96
TLSH
T1D641B74289603091F7AB53758AE037977AF4CE4E31432E330DA8F9BA5B06F3C2664861
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8922923f5564a7b224aa956a858fc1af67c77887a8b3652b5166b57548db04ab
MD5 b9df485e555afc21b38f6eaa0f24703d
SHA1 91b9d4e6e19d092c14298929f6292a24a1d20ff2
SHA512 e5aad1b584e8eaedf12522f09f5b4c9905d0988e7729de2d0919aa28fb34e4e8b2b6dc7620ae5311974a83fc85829907c4065ecbfa70dd0944d0dc40b8aeb525
TLSH
T17A51BCF7C2E8837D890156F4AB147E2ACE1E0955432C3D56C8E4AF5F63E28B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2e47b11d30a3bae3be6f12e4f6d235a201a2b75bdd0c991b3dafe0660ab4aceb
MD5 f457b89632f35479ce1304a3902e58bf
SHA1 4f30fb5b29f12db1083618df322d257823d3a1b3
SHA512 c9a25986d36408be2f0feefcf829f9995e31a7247bf35ffd2740157096056e8eb855a39eeb74de4f3fe48f0938e008912926fe164e1e0932cf6572cd66ae30a2
SSDEEP 192:sxRLmbe/fUsqHRQuzoA8p4w/g6+WNIYEfDGaIgDLJ:sxRL4e/fUsqE9/5IpZ
TLSH
T12C32A715AE28A97B8CDBE21DBB557F53D2F9503260951E48F6FC861C04EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6f706fb866d5c36a5401cc8c181091ab18d32861e3fab1114002f1130c5e05b2
MD5 9580e3326163df6b1ed199bd19b20e27
SHA1 271da862ab5fdfbc8a8a0b00100af065f46af369
SHA512 376eb6036e9f3b4859eec27d925e53c1851118f9a311e9aad8bcb65d1fd4119f09fd15d2dcfae55d0b9e0ce084115f1da5ad92c15a09bc84fc4715b4eab67b5a
SSDEEP 192:sxRMmbe/fUs0HRQuzoA8p4w/g6+WNIYEIDGaIgIJ:sxRM4e/fUs0E9/5IGs
TLSH
T12132A615AE28A97B8CDBD21DFB657F53D6F95032A0911E48F6FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2b884ecd59021df50e95810722e5b411c82a68126aec63057839399d729d1859
MD5 a7ad0218f1a3f9d3b877f2dc5e82ffae
SHA1 598cd1fad55a976d9499a39ddc4c0a2cdc2abb8d
SHA512 8a5c5e9eaedc920ff85200e0375fdbddb62380c3222b2e99bde4d282931129e1b38b968ffe01cbfea53dc4b63cc429af737cf9a6f94dba3c9cd9993df588b065
SSDEEP 192:sxRLmbe/fUs9HRQuzoA8p4w/g6+WNIYEIDGaIgDFJ:sxRL4e/fUs9E9/5IGr
TLSH
T12E32B715AE28A97B8CDBD21DFB657F53D6F95032A0911E48F6FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 0fa4043f7a46b8084b9888eee4d7c6ae1717bf0d428ba0edc571e9e720810a0c
MD5 16e388cdb0cd3f9a853fd2ded11cd54a
SHA1 e6cb04e02e051fc72a34190158c2da655a723319
SHA512 3a4f2350e46803ea1eab0e696cc7d11066a595284e2ec38168139f68fef886d9bbf89c7f1d915e1bb055399bf6fb5af2708e41224731b8907eced177ff638677
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXUroJeQ:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0V0
TLSH
T139B2C92B640CCB7F4F804A9EAC196FD77D9802C79A588D4047FE995C02C77EA91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a03711578d5cf455f8193cfaa981b8eab9ebb142a9b4e8b09e3749ba42830970
MD5 572dad7f87ea01ce322a19afcb4ca413
SHA1 78adb1d07a68e14499f0b3b2ae47f55bbe27528e
SHA512 13559dc306a215ac5ed29d6cdc4dcbdffbe176c67f301085c2b1274d3b13334858b02b04c5b5108f8fec232fb5b8e1b96f2c3d8159b220ec0f21ae1acd7b36b3
SSDEEP 48:KYdIFKeo4ny5+I/K7iEvyFTI1Kk044SRMoqUm:KYdSKeo6q+AK7iG+TKKk0dSRMoqUm
TLSH
T19B911100B5B6169438BD650C80EAA71F46923573712DE73B3F7C68A25E36E082DFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

24f2ede3-f07f-4974-854f-2ae1113dce2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\24f2ede3-f07f-4974-854f-2ae1113dce2e.tmp
Size 22KB
SHA256 f429961ace041200b0a6f4a3fb8e693fbc03721c6ac63bcc34c17d3e99ae0e7a
MD5 50e5faaa44d5d76aff26a151a18c4cc3
SHA1 0c539a4106cf75f34c81db5d295df51f35566354
SHA512 9ed9e069af12cb64ad0e1dac13912dfa8ca78741416e1c71d48cf8726b6cdd17a91a63ba9a642fa0bca5e1b77bed00e60465d75df1f4ab83dabe673c54bbb3a0
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ul:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAk
TLSH
T17EA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6fff249f35a8b31a57cb0ee2aaabf8ff03c90c24f2f5e21ab7ba20055abb1cfe
MD5 3789425458dec9d3ec4b408b19465376
SHA1 58694cd5c530ffcb32983d5b382e5f09ed1643e3
SHA512 a631ff27d0c275a4ebeca17f119147ea473dcccea78a295c607bcdbb1628fa518eb9cad83351cba158271c7c80bd825a5ccea81c263f2620db70cc523acb535d
SSDEEP 768:sc3FElZc7fZrKxHkPap5XSwQs88uBkiT2Iw2sg5:sc3FEstrYEP0ILNBQ2sg5
TLSH
T140F2AF35E8E488B3ACB693C2768B37026FF05147D4C8069885DE761D02CB76E274B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b1768ace4b8413db6ba37efe613a471939835b567493ab965839304a0664b0a0
MD5 29052fb966bb8d56e8b0ad2b2877f3e7
SHA1 6543dc8b95911271739241ef5abac6a34df1ef07
SHA512 213d277c2e2be424fd5961ff7fefd3c42a7687d6f59dd69907d41db8be0eaa31b0d95ef70cce9fca25a5b963a9bfa82ade16d793c1ba62cff41ec057468a93b3
SSDEEP 768:R/UxvxjgC+W3fF0c7fZrKxHAp5XSwQs88uBkiTCt/P84g:kZj3+W3fltrY+ILNBIHg
TLSH
T1D303C039F8945873ACB39385365B275BAFF05053C4C41B9849EE7E0E028B75D670B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 26eba50f5a35b97250f9577d613a01c5c585b63f016605c6355095f7e509cf0b
MD5 294eeb03b9f9ff25fde6d6883711888c
SHA1 23dc93bfda847d1eec8e389c91bf65d5f047d9a7
SHA512 5a42b459169a70ded3c648a611902f8eff1f53dfc14373cd28c7810c8be4234cdbccdacfb7f119a70784945ce7dd1ab9916678cfea7098b04461cccba9f73286
SSDEEP 768:Tc3cElZc7fZrKxHkPap5XSwQs88uBkiT2Iw2sg5:Tc3cEstrYEP0ILNBQ2sg5
TLSH
T14FF2BF35E8E488B3ACB693C2768B37066FF05147D4C8069885DE761D02CB76E274BC5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f9c62e48a3b0142b8ac39a1deeffb947d68e8ae1bb9c975caa755a4401d1c392
MD5 033f8ac5fecef1b469983b298e001f76
SHA1 ceb25fbf82eabb95621db193a377d8646c6e8643
SHA512 ae4f44342259e43426e9426c8f08b9b3b923ad21e02f62e1d8f808b496dbafb8f30b94228b93523bb418122c331388600c5bbf78218c08b050aadac5206d6b09
SSDEEP 768://UxvxjgC+h3cEZZc7fZrKxHkPmp5XSwQs88uBkiT2Iw2sTq:SZj3+h3cEAtrYEPYILNBQ2sTq
TLSH
T11203D039E8E45C73ACB39381378B2347AFF05157C4C416A849EE6A1D02CB75D674B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

189689af-e023-4684-a2a2-f1ab78824cbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\189689af-e023-4684-a2a2-f1ab78824cbf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fe1b0aa0-71d5-4e03-b238-a202b005f4fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe1b0aa0-71d5-4e03-b238-a202b005f4fb.tmp
Size 36KB
SHA256 4889d49b8b60483c1362a09639daf95324bd25e70d5f6694d47394310114f202
MD5 5108522d17cfa84f27301ab53138e263
SHA1 a053afc0bc1c9534369ca0f9905a6d9f7b25e13a
SHA512 75cefdabd1f14ec27dafb2549d21f064c59e681b856e7e23266756771441858df53504243f128fcf612f608609919472b8f35b1eb0204a8fa1e921c95e9f84a1
SSDEEP 768:7FQ931wgzElZc7fZrKxHkPspp5XSwQs88uBkiT2Iw2sg5:O93vEstrYEPsXILNBQ2sg5
TLSH
T14FF2CF3698D4C8B7BCB68BC2BB8B3302AFF05157C8C45698D6DE691D018B6AD134BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download