31cceb9bab6a3b063a27064b6f2fed8d818e02f6fe7e7a34303f1a4ad6732a32

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-it
resource tags

arch:x64arch:x86image:win10v2004-20260911-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
optionals/Optional presets/corona light/screenshot_comparison_QV-thin-rays.html
Size 2KB
Sample260930-nfad5ashnf
SHA256 31cceb9bab6a3b063a27064b6f2fed8d818e02f6fe7e7a34303f1a4ad6732a32
MD5 169b41e351e27133fc1f3283e3392786
SHA1 0fb50d843d113fdd3f6e25a10a2c964b1b778a96
SHA512 5f45d1d2ad0b273d46aa93b2dd75e1779acda57fc391ae5df04dfeeb988160fb9bf84fd25699aae458ddf72e0c527d0ee1aee9c9be389659604a7eb31172a33e
TLSH
T17141857320B35C19306F85BE27D5E28690556185E38AA984B0AFB7F7D281DD3E8E3C49
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{D92571DF-4C9A-4F67-8F0A-ABC4A2BC1341}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 604	3180	msedge.exe	88
PID 3180 wrote to memory of 4916	3180	msedge.exe	89
PID 3180 wrote to memory of 400	3180	msedge.exe	90
PID 3180 wrote to memory of 1500	3180	msedge.exe	91
PID 3180 wrote to memory of 400	3180	msedge.exe	90
PID 3180 wrote to memory of 400	3180	msedge.exe	90
PID 3180 wrote to memory of 1500	3180	msedge.exe	91
PID 3180 wrote to memory of 2564	3180	msedge.exe	93
PID 3180 wrote to memory of 1828	3180	msedge.exe	94
PID 3180 wrote to memory of 2564	3180	msedge.exe	93
PID 3180 wrote to memory of 2564	3180	msedge.exe	93
PID 3180 wrote to memory of 1828	3180	msedge.exe	94
PID 3180 wrote to memory of 1828	3180	msedge.exe	94
PID 3180 wrote to memory of 4128	3180	msedge.exe	95
PID 3180 wrote to memory of 4128	3180	msedge.exe	95
PID 3180 wrote to memory of 4128	3180	msedge.exe	95
PID 3180 wrote to memory of 412	3180	msedge.exe	96
PID 3180 wrote to memory of 412	3180	msedge.exe	96
PID 3180 wrote to memory of 412	3180	msedge.exe	96
PID 3180 wrote to memory of 448	3180	msedge.exe	101
PID 3180 wrote to memory of 3364	3180	msedge.exe	102
PID 3180 wrote to memory of 448	3180	msedge.exe	101
PID 3180 wrote to memory of 3364	3180	msedge.exe	102
PID 3180 wrote to memory of 4516	3180	msedge.exe	105
PID 3180 wrote to memory of 4480	3180	msedge.exe	112
PID 3180 wrote to memory of 4300	3180	msedge.exe	113
PID 3180 wrote to memory of 2428	3180	msedge.exe	114
PID 3180 wrote to memory of 4716	3180	msedge.exe	123
PID 3180 wrote to memory of 4716	3180	msedge.exe	123
PID 3180 wrote to memory of 2728	3180	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\optionals\Optional presets\corona light\screenshot_comparison_QV-thin-rays.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffb8a5ec188,0x7ffb8a5ec194,0x7ffb8a5ec1a0
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,3328020709250140993,6339756247243228806,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,916587489335373495,17362700523372029501,262144 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,12718140102345904783,7460538923907514449,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5883002301555892127,15325519030267832936,2097152 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,776401754617917063,9449458943258036234,2097152 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8455599220739203951,11231893854333836899,2097152 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,6754586231361410974,13979319321176400646,2097152 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=it --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,17707714002876260961,9365350983689105239,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=it --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5078885362766866107,14379493898141358677,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,17268406426171756229,17178116467834881578,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,17268406426171756229,17178116467834881578,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,16130906057853139346,13564684118660084769,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,3400292471967726326,2858854477256968096,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8795403275688318653,10145715432570979744,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=it --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,1047323686893963027,15896548867483104468,524288 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5928,i,4251200971428476665,16417023552413377337,262144 --field-trial-handle=2364,i,4391807966378719973,16899217104655398809,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6e6b889c56c460f9cd69f5a8bec4b155787c74dc296e140e74fbf1ad34bc123d
MD5 93380f2745a8363bd12579342c1e143f
SHA1 13cbf2f3fe8abc59d3a5a02597dcb87410688c51
SHA512 0ff43b5fc8bc01b17d71f6529921a1fb81b0b3d84cdd54ac5e623296b2d8a28c0f07c9c863369cb8875b8e65c065d1cddd4528c9346b79cbc0315420905074db
TLSH
T18D41739C4EB148BCD7EAB531D2F10B473634CA71A58B3E5A059AF5BA4F0AFC143580B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592522.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592522.TMP
Size 2KB
SHA256 9d5af7af2b31d8a194419ebeebe342b05e2fba87cdb22155b7c419cdaa993ab0
MD5 decc424a8ea1b3a9257b5d680bb8aca1
SHA1 12dfa4ba59adefdb87b6b609f4d5c8b7072f7636
SHA512 3c72267e82ee1e0615e650d59a36a39dd6602d868f4c5109f1ebc0e7fa83915d010568a9891d8c53220e16f581f271d065598682225b25f113cf53d72e99a940
TLSH
T1B941739C4EB14CBCD7DAB131D2F10B473634CAB1A58B3E9A159AE5BA4F0AFC14358074
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e13f28ce083cec8f78dcb6d7f2d356ca1bc81a8ed4c7be46b5eb4db015786375
MD5 e270cf3654a5fcf9157c3d02f9a3a7c1
SHA1 320a7c46175ad0af66d25b2b06b423f31dc2e174
SHA512 0613a25cf995293c3a1d3f8b2696892aa8c16bc8cbc6ef1b7989ddec13450409812883c2165454a727bcc7063d14c481bbbf647562e2f20847abae94596c2335
TLSH
T1AC317CB6C2D8477E881552F4AA256E16CE1E054A422C3C5A8DE4FF5F73E24B0E20199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9de90308cf6eb185d4f3a82f81861ac7470fa7cfcd6c1650838fd06975aaefff
MD5 dab13fa645a63a0598f5615eaf499b25
SHA1 765c19fc71df5b560fcfbcddf27633e14fa4046b
SHA512 131b679ac8f6f712e614c0a2b42ab0248570395786f4a7ee0f70f3b78794d20fd322a7a4a245991b3f059da93c4bd1c9a41cf977778ac85ade6b7fb5a9732819
SSDEEP 192:sxZLLWJ/fsXs3iJIupdlHW6+WNGYapY7sIgrJ:sxZLqJ/fOs36/HbGZ9
TLSH
T1CE12B7566E28A97B8CC7E20DBB55BB53E6F9503291D51E48EAFC861C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 34d42619927a143e5ff3630fcbaa4551916fd1c762c7ea611b8824209f547a79
MD5 678fc7c65102571aca8387da0555ef34
SHA1 6e402545736f2630bb8e8eabf778d0db9e11790c
SHA512 3d3a86109c4f65ab5b32411131aebd4acb5956c3705adb759b2ff8e3fa7c78ca0c6d5740a30f26d301aea50ef53d7d7ce1b45f11e1f1213f31fbced780e43537
SSDEEP 192:sxZLLWJ/fsXsLiJIupHlHW6+WNGYapj7sIg5EJ:sxZLqJ/fOsL6FHbGem
TLSH
T18C22C8566E68A97B8CC7E20DBB55BF53E2F9503291911E48EAFCC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 dfd7a3aa9d5fdac99788a646001dfc8778a98490b7c7e8ea02f29d4fcc1f3a70
MD5 00714a4e23139a216ff2d4d93fafc36a
SHA1 4816f94f99dc8c1f2d934d1ae18a66f904116c30
SHA512 93f170f653b1d0c732eb395b9f0c3aef48438cd937272fc2d0c2fbe970a549830fbb342275137eea4ac50b372fd040ac51a3d3a913b775201d276b386935db84
SSDEEP 192:sxZLLWJ/fsXsLiJIupdlHW6+WNGYapR7sIg5EJ:sxZLqJ/fOsL6/HbGwm
TLSH
T1C622D8566E68A97B8CC7E20DBB55BF53E2F9503291911E48EAFCC61C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b4430e47ac662b6641db4895eb8c4cee2e1f40e21d9eaba0413a167578f44b2c
MD5 21d22def65829d1a5465af98a20a521c
SHA1 4e428a104864dd1cd44d9e00d5960678ccc0d60e
SHA512 b16ce6259263cde8b88845644cf89e4b6ead63f6dd3716c87d3524a277eede3dfd675728ba5f9a4d2685b81916bdc5391f62a6d65fd3e9acbfb635b1eb76911b
SSDEEP 192:sxZLLWJ/fsXsXiJIupdlHW6+WNGYapY7sIg5uJ:sxZLqJ/fOsX6/HbGZs
TLSH
T19712C7526E68A97B8CCBD20DBB55BB53E6F9503291D51E48EAFC861C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6c15471523b78cab237fabf6b7ec3bf7749624f19d23873056dcc71c9ed0abc0
MD5 ed6cb9162576513643d0c903dcde8f4e
SHA1 51af737f4d10192a064127f24da15e36fa70faba
SHA512 8f047c0cd8e8fc123b45f49d995a7ff87a3fc981e5e03c7dca0c96c926e82eef57094f9df235ee2ec620c6b9b854d2f40632f33f12d8df9c0c4aa1b155963904
SSDEEP 768:OSWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Vro4kfeomRS:OSWPcLKWvKeEeu1jaClLiF7u4kWomRS
TLSH
T150C2FB3F644CCB7E5FC01A9DDC5A6FA76E9802C79A544D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b35ad9742d751ae418d57419aafdf1db3528dbf897e800500f43a181c1dc44e1
MD5 171b288d67540d4ea7c83c1550a35af9
SHA1 ffa63b941f6b43ffe8dfd68ab1cea0560da51a9e
SHA512 0b85b695e26e3cab43848d55b7a82123b1579f67d384bd8694be33cf3998ccca5a41eb4137bb5103ff2ffb4ddf715c72b7cf01e3b226c03258b13786a15c5118
SSDEEP 96:KobUvrVhtE9h2vvDEK3hvNEzLrWVLZeHCKoUbZ6K6MiQd0JNTXzIfz:aTxJ1Qd0JNTXz2z
TLSH
T15D912A0475BD121039BE251A92B4876F864131733118FB3B3FBD54A55E66E482CFDCE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3ce81a5-3e7f-40bf-a08b-d3017fe69818.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3ce81a5-3e7f-40bf-a08b-d3017fe69818.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 f429961ace041200b0a6f4a3fb8e693fbc03721c6ac63bcc34c17d3e99ae0e7a
MD5 50e5faaa44d5d76aff26a151a18c4cc3
SHA1 0c539a4106cf75f34c81db5d295df51f35566354
SHA512 9ed9e069af12cb64ad0e1dac13912dfa8ca78741416e1c71d48cf8726b6cdd17a91a63ba9a642fa0bca5e1b77bed00e60465d75df1f4ab83dabe673c54bbb3a0
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ul:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAk
TLSH
T17EA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c078.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c078.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f5ba209bd0ef795700d43568ee5dcd74b5f2c995b7c4912217a3ab490d992359
MD5 955d0a9b801be8266fb635cc8a053153
SHA1 1cdec1eab717d1ea6bb9df4bb63800eb052899a9
SHA512 c4fc2f9a263d686974567e4d6434ff6910971393ab23c92ef3b6e53faa21a2aa775ce21e87e2c6a85cd518df80bce28276179925844936c0e6dfc621380226d0
SSDEEP 384:/ZcIhsNqnR1kH8zIGmnq+oYCiYYiXtgOIwZOydRo8:XhvsWoqCJriXXsyX
TLSH
T17E827C729CBC6C7B5DE79205F58776135EB88127D3C96F8498EC5B1C01EA2A8030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 423a0ad1eb378c91a54ddcafb9b2bc4821972302cb81d5d91086b48744dd45c8
MD5 b27a1645b263db028203cf5e2e806136
SHA1 386fe0c0f722e3a946ee2d65c33077e49455390c
SHA512 76bf3af3d79366ca1f75c300641d01b80a7eebd304405d7da09aeb946fa6b3998be86170365bcc34b9290183a54461cdf839526010fc4637f74e3eaf3f52aecf
SSDEEP 384:OTFiZcIvIzsNy8TUNTUlIlKR1kH8zIGmnq+oYCiY8+iXtgOIwZOydRo8:2FQv0nwg0sWoqCJ5+iXXsyX
TLSH
T196A27D738CE89C7BADF79B44FA4A36139FB44167C6C5AB94E6DC5A1C00DB198030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be23baaa2769b6eb797350219f853c4bcc1df769f3befd3c4462bc482f3c3686
MD5 1cd8013f2d6ccdab07e2c7815d3c01b1
SHA1 a7e9c70ad32c954f0abb68bf0944e0b79ea088f3
SHA512 414975fa335334b9bc2f3bf2abe512b0a8278542bd5968614940c98a13b76a3541ddb77802df0a6ce0ec0530f60a2d3f0768715ac3e9549c32815ece1f56959b
SSDEEP 192:aON46IE7QmiUym9TPuIGmnq+oPC7s8QU6:aON46DtRPuIGmnq+oos5U6
TLSH
T11302E835ACB87CB78EF3AE09F4877A235FA5112BE5952F84D9E81A1D00DB25C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9dcd97786049ff11e8793e32bc211136e8fefe488fbc0c0a78ba4ad5ed2c00d3
MD5 d9fe82c6bcb5c8adb626b5005a7a6785
SHA1 ab8133a99342ee2c0504b99950331245ffed60fd
SHA512 d7c2c6ee04a60be87a1a6e9ed8902acbe2f2ece3e4bd30d40885bd3330835bcb28e31038ff32690b7a655ec5996133e20801f582b529f9cce3c3ef6102beeb71
SSDEEP 384:sZcIhsNqKR1kH8zIGmnq+oYCiYYiXtgOIwZOydRo8:6h8sWoqCJriXXsyX
TLSH
T173827C729CBC6C7B5DE7A105F58776135EB88127D3C96F9498EC5B1C01EA298030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8eb6129ccd4f3111a58286f2aadc0a1431b3d086a358b96e3a299ddc13d55d42
MD5 5569350616e4a441d2e4e6861ed27c10
SHA1 0a50afa7d65086568646b78211bde9c2c9316b0b
SHA512 4f8171346f37666bb1d5a5a8efecd795ab5b973b5c092d5c168de249bbc1c4bf0aac5967dd29c9efe44d48d006c63ae9bca53f16165f63b5e7a95e9fe600042a
SSDEEP 192:aONb6IE4QmiUys9TsuIGmnq+oYCbGPwn027HlqALU6:aONb6DYzsuIGmnq+oYCiYNHXU6
TLSH
T120121936ECB8BC6B9EA3A944F48339135EA55227D7C97F94D9DC1A1C00EF25C130BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9703ef3b-cb06-45ca-a88d-976d2a90f920.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9703ef3b-cb06-45ca-a88d-976d2a90f920.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2368cadd63669e8624c7db2f82298d68821a41f8aebf5642d2a845f2b22eda6f
MD5 bfeb6fa64de81a7994c175bac9ffc902
SHA1 75b318e8860c8903e3e84c2e40110b970eb4e39a
SHA512 e0bfbbde175482d1e46fdb3c3b21ab009ee9cdff34ac678864a6b8a93d7ff80f544fd2eabe23f0ef0b2ce692699593369a81252fb74cf2300797bf50d8b27772
TLSH
T1C1412859B6EA1148B3B36E56ABFAA82D487FB9372E0AD45D10110E4F4722B00CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download