hxxp://agenziaentrate-gov[.]lestrani[.]de

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://agenziaentrate-gov.lestrani.de
Sample260720-l83j9set6k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290159955509122"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E379F366-5EB6-40B1-8852-2711052E4CD4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4988	3512	msedge.exe	87
PID 3512 wrote to memory of 4356	3512	msedge.exe	88
PID 3512 wrote to memory of 4224	3512	msedge.exe	89
PID 3512 wrote to memory of 4224	3512	msedge.exe	89
PID 3512 wrote to memory of 4224	3512	msedge.exe	89
PID 3512 wrote to memory of 1572	3512	msedge.exe	91
PID 3512 wrote to memory of 1572	3512	msedge.exe	91
PID 3512 wrote to memory of 2296	3512	msedge.exe	92
PID 3512 wrote to memory of 2296	3512	msedge.exe	92
PID 3512 wrote to memory of 2296	3512	msedge.exe	92
PID 3512 wrote to memory of 2868	3512	msedge.exe	93
PID 3512 wrote to memory of 2868	3512	msedge.exe	93
PID 3512 wrote to memory of 2868	3512	msedge.exe	93
PID 3512 wrote to memory of 2760	3512	msedge.exe	94
PID 3512 wrote to memory of 2760	3512	msedge.exe	94
PID 3512 wrote to memory of 2760	3512	msedge.exe	94
PID 3512 wrote to memory of 332	3512	msedge.exe	95
PID 3512 wrote to memory of 332	3512	msedge.exe	95
PID 3512 wrote to memory of 332	3512	msedge.exe	95
PID 3512 wrote to memory of 1076	3512	msedge.exe	98
PID 3512 wrote to memory of 1076	3512	msedge.exe	98
PID 3512 wrote to memory of 1076	3512	msedge.exe	98
PID 3512 wrote to memory of 4544	3512	msedge.exe	100
PID 3512 wrote to memory of 3956	3512	msedge.exe	101
PID 3512 wrote to memory of 4544	3512	msedge.exe	100
PID 3512 wrote to memory of 3956	3512	msedge.exe	101
PID 3512 wrote to memory of 1524	3512	msedge.exe	103
PID 3512 wrote to memory of 1684	3512	msedge.exe	109
PID 3512 wrote to memory of 4808	3512	msedge.exe	110
PID 3512 wrote to memory of 4460	3512	msedge.exe	111
PID 3512 wrote to memory of 2948	3512	msedge.exe	115
PID 3512 wrote to memory of 2948	3512	msedge.exe	115
PID 3512 wrote to memory of 3132	3512	msedge.exe	121
PID 3512 wrote to memory of 3132	3512	msedge.exe	121
PID 3512 wrote to memory of 1632	3512	msedge.exe	122
PID 3512 wrote to memory of 1632	3512	msedge.exe	122
PID 3512 wrote to memory of 2976	3512	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://agenziaentrate-gov.lestrani.de
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdbabec188,0x7ffdbabec194,0x7ffdbabec1a0
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10827971494120791518,5197383784609974528,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9242910841623826774,910912222481784839,262144 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,18395689595222504478,8100470584344331074,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,3817830177117182611,4009005154874681161,2097152 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,7528071947494477652,10632687049244927327,2097152 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11282046977476198069,16764876511898795786,2097152 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,5231081141882590175,103385480284119995,2097152 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3508,i,7341598651885945970,5546995994309617980,2097152 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,13749423285168851622,13476696525338419770,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,9157987674271096289,13563868734231744213,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,11308074869151253130,14397065740129566538,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,11308074869151253130,14397065740129566538,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,8028372960631879853,8032853380345627869,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,17756523791189133731,9451836844201458383,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,16507894719483651847,5902589465472460932,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2912,i,10373150465650029833,515765397676131863,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,13010016137889401701,10266377007248635095,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=776,i,17296581024475732156,11627645279355466797,524288 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,16766606224745136140,10186391732841884974,262144 --field-trial-handle=2256,i,13487216127432046150,10246901059279538015,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ec36e8799e6b8e1ea940179089699e2e05717beac35e3e9643952b13f921e278
MD5 55cf71050a7ace8e3d476c6830a32661
SHA1 e1d43079b6be71f13370ea00ebe21175001a910c
SHA512 fa9d4f6e21ee96aa93c6953d2b113715f1844b9b1b9639f345c213a0da57dbfaca60cebe0b52336916c53e8c7885f0f02a6d483c3f7e3105c68a0410c06a16d3
TLSH
T14DE07DE404C8C2FEE640644741FC738DE280369BE2E8A93B5708C4C9B0032D0B3F66A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac1a7a02452d87e4de98e76724f3e856658f471236d4f0bd2032d5dd39de4cc2
MD5 c91436f61bd65900b4b060d1997cb2e9
SHA1 e0d3f4845e5bbbe70897558040e2e23761fae52f
SHA512 4965ecdd4130cdec86d5b3022f882ce0f7e365ab32e4f21c647f4374c8f5d9dc6baa4c3a881f66609fcb14f8c6958db5b5ef6fbabb07103ff70f4d4bfbfc2cbd
TLSH
T19B716F3820434FB9EB22A17388CE209D7B3082F4F4135ECD5CA4E67565E1329CEC6749
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e172.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e172.TMP
Size 3KB
SHA256 7afd5129191c6ab30f4321f96b5a4c8445325b110692f49ba2d03dd7c6a79de6
MD5 68844f8d1eef75c95be5ecefad54b976
SHA1 964b71137f304b9be79935cd6ec7393ed9012ab8
SHA512 42573ef594be851be8035ddedcaecf39f092f1abff607f0eac271ff8358ea311d991c6eae5b3abc4b6482357252567e72cef46be7e2024e4a00f69d72e93cdbf
TLSH
T117716F3820434FB9EB22A17388CE209D7B3082F4F4125ECD5CA4E67565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0bc98ffa7efb0afcc2a6c230d04b4d639a0b6cf13aa04035b870157fafb12c85
MD5 e5ac4b1ff4ed591c99be5ecc0654dd15
SHA1 225f81f2590bf3f391ebe450adeb2a36c198920b
SHA512 66cc71ca208f4bc8e4722e0f17204dfd219e32fa3ef53b3681d55e65d80a90d4766ed6bfc1069423180f4f4b1aec3a4d373ef756766261e098e6b04a3d49b102
TLSH
T1A611ADF3C3E5866E890116F0AA14AE2BCE1D0615831C3C2986D4EF2BD7F3475E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0d260ee5f6a0cd9dcde3a2f01a5d2255408cd851101bfeb95b6a7ae8be47a4a5
MD5 9ab8ece39965ea6ce5a0bc5c5d892994
SHA1 11743a4a628430dbc5cbec349ad0889e6fea4fe0
SHA512 7a25325437b16fb1decbb3b204c122ab80c3677925b7c32487c55b0db95dab8142d2da1cb3209260bbd3662e97953fa2ccbde138518ff26dde5b7ccbcbc9afe0
SSDEEP 192:sxZ4bRIkE/fesaMBJBIdp2fHW6+WNVklT/Yzpm5+YZIgrJ:sxZ4bxE/fesaMBMQHbVK/Bf9
TLSH
T1B922C7566E28A97B8CC7D219BA15BF53E6F9503295D41E48E6FC861C04E77CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d7616400b5c1082dcb8d07ab3f8f45033d02f7c741dbd036eee91870a0e34612
MD5 792772701592969b0bc583eba42a817b
SHA1 495419d9bd392468e42bffc7fea12956c6dd304c
SHA512 d1dd02fc7b71d7f3cdb707247631d5b1a855b4c9bcf6c5b139ff35d4a237d7f5ce7985de83014e5dd86e9f55010a77c49a6a3af157f96dfba4656543099a7c75
SSDEEP 192:sxZ4bRIkE/fes+MBJBIdp2fHW6+WNVklT/Yzpm5+YZIg5mJ:sxZ4bxE/fes+MBMQHbVK/Bfk
TLSH
T19A22C6566E28A97B8CC7D219BA15BF53E6FA5032D5941E48E6FC8A1C04E77CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c88eb44df3baa791f7c1ac3fa6972e0f7553564bd981e7fd927958f5d972cc48
MD5 2caf874f286376629231da23a75656da
SHA1 0c385691f515cac42a7886a09805e749f6155f56
SHA512 9e00dd4a33ef537c6888ac157a87c13b47dddde050fd4e146afc499e06c0ae7c84480829b22cbace22a80937a8309aea0c85bfcf977b63a7da22d98207c18fd6
SSDEEP 192:sxZ4bRIkE/fes+MgJBIdp2fHW6+WNVklT/YzhC5+YZIg5MJ:sxZ4bxE/fes+MgMQHbVK/XfO
TLSH
T1DD32C7566E28997B8CC7E609BA15BF53E6F95032D5941E48E6FC8B1C04E77CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 86e7811c5df373081ae11f79dfaae293a440bcf2fcb39e764f1428ec93d78e69
MD5 c4f2e34d158dc0314e23f286e3b1d010
SHA1 c501ac7502af7416e88159df9170f79d825d156a
SHA512 4f5faff4faacf63a3fa879b7e9f44757e00eb7468ee95ebaa50f3807f2d5cacf820ede6f4c57b6e00c48ea5062adcd2fa2356735e19ad96f77fbe9f88cd8da97
SSDEEP 768:3bk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSB0royf2Y3:3bk7u70WvqiEau1jai5LA3BfQ73
TLSH
T15CC2E93B744CCB7E4FC01E9DAC566F963E9802C7A6988D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 31944fd23074c827312de926e552075ca9cdd4b654ac02cf139c39528868cebc
MD5 4b7fc9c7b5eb93295a663bfbb04fe10b
SHA1 3b8a64c187c4037b27beb83e37f22b9009ea7abd
SHA512 bb505348364264e00506bd549133cc346fd1d530a7076ca107b489930973d5b76bde7556084e28fb4e18b41a8eafc287bc2ccecc358cf806b06f161144eeaab7
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfJIdKiQoPyVvI5KYIMgjIlKMUl:KIbCKcfJiKiQamvGKYITj6KMUl
TLSH
T1E5914952773B0601387E280897AADA375E8331937419686F7BB801B11E26F215FFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597c99.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597c99.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 dd688d44d78be222668c0d90f26e41c53570096f405fa255c359465abe035063
MD5 cdb02604b07395dae797228fe853187e
SHA1 54332360a5fa79932d8ed28bc037602fffb656fb
SHA512 b847ffeae87176afa352c6772e64dade1b413818da19eb10fa152cd3fb8c774886dfe9fe4c7dfd0e26f804166349bd75abd4678c08fa95498308d49d9bc7c150
SSDEEP 384:2tNn/s3n9SfsNHUkR7WBtbCt/OdWGimODHOObjI9G6w7fUA:2j+9UvBtKmoGiPDH29Ml
TLSH
T141929D365C35AE374E925656F0863A575FF8917BD7C82F84E6ECAF0C02DA2AC531240A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 13c4553adbcd68f31ea5ad7afb15292c123f13692d71217899ebee0f076a525d
MD5 f97f40dfc16f18f9cdd987d4926b02aa
SHA1 54f16a944a05c20b3d39c7bead8ca49af1ba35d7
SHA512 292f9cd6d588352bc92bab0c2808e218c68500c65f5a58ccf1aa70a9b93412da9ec7a638c65179a282a97158d617b7f1f2f26ecfa4acfdd631aa3ad733361a45
SSDEEP 192:MON364BAQmiUyr1HW5GBPKmx+FdG+Po5Z4aDVZ6U6:MON36eAchWldWFr6U6
TLSH
T12102E839AC796C7B9EB2AE45F48637175FD8113BE6812B44EAE85B0C019735C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3a32c710191cca15748e4956e390380cb8cba22e87f3e101ef9a1831f9fba868
MD5 a8ce7712464f3fe580cc4e2f64c0a950
SHA1 f42032969c192e72fbcea59b56623b82c5e9b11a
SHA512 05bd6fa1cdb9de19ebc8fd7458a6baa06ef4a9faf095da419363efba08559b4e6a16df82fb069010c531ead40166d2470e08ab3456014d3afbca735f3c94301b
SSDEEP 384:PtNn/s3n9SfsNHURR7WBtbCt/OdWGimODHOObjI9G6w7fUA:Pj+9UOBtKmoGiPDH29Ml
TLSH
T130929D365C35AE274E925656F0863A579FF8917BD7C82F84E6ECEF0C02DA6AC5302407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dbed31ae2764cd0acf9f02c42c349df901b1aac529eefb123fbbb6835630f269
MD5 80178724af88389e7f060faaac8c42bf
SHA1 2f74dd74d7e546dd834ffc7dc8c5b6dbf409269c
SHA512 f78b4619dd4d0dca2dca30480ce7b7656f95d2bca1305605d38af5ec23f169037e9a914827488c1815b7772f4328271897b7c8b4663f9ee7833802ec602e5a13
SSDEEP 192:BON164BWQmiUyjHd5GBPKmx+FdG+Po5Z7pEimMzWwrrqmsiU6:BON16eyGdldWGimcDHU6
TLSH
T1ED120A366C78AC6B5E927541F48736435EA8512BEBC56F44E6EC6B1C01EF3AC2307417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 da520377ab4eb0285004c42dd2262f08fe9608235913bce82bf2c65b1d6b3647
MD5 d97391dc6a5ce2611dd8c3eca1c04350
SHA1 ac8e58e813008216db9ca370bf5d8a5f4ecfcbba
SHA512 82719786ea311eb9e49735d67769ff14cbaa03789f09f68be474d6103b678a2de9da189db7fe081979df63eac4a06222fa8dc52bb489b5f7f3a3c51a3e50ac7f
SSDEEP 384:miF1tNn/s3n9S8zsN88TUNTUlIlRR7WBtbCM/OdWGim3DHOObjI9G6w7fUA:NF1j+9HNwg4BtnmoGiMDH29Ml
TLSH
T14BC229F248D7893ADA5E4B43B77D2E124EBCC167F6846A44B3D89A0CCD961BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f3e5258-1a0c-4f92-b47b-19f8f4baaa76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3f3e5258-1a0c-4f92-b47b-19f8f4baaa76.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 32d963aaafa6b4fe54a0bee4e966b01a5abf3a91e9d4a78056f9d35b5441b4a5
MD5 fa482137ea08f6e07f6e0df08762d480
SHA1 c074673421519167b84fea032c316a1f05dc1ca6
SHA512 c376c07f35dcdb7ee0dd68d8f1e82e4290cbbd16144634c74a22559e4ea12785b558c5841614e61bef8ff7534a9e13b7a631c25a2b61ead3eaa203e15ae012ff
TLSH
T18B415859B6FE1149B373AE1AABF6686E447B7D372F0AD55D00010E4F0B22B40C8A173B
MD5 SHA1 SHA512 TLSH

Submit Download