hxxps://avvocatidinapoli[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://avvocatidinapoli.com
Sample260804-r8ljmsgq41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303287202237221"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{AD461D10-72E0-4933-8B41-515B7C693765}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3800	5004	msedge.exe	87
PID 5004 wrote to memory of 3308	5004	msedge.exe	88
PID 5004 wrote to memory of 4736	5004	msedge.exe	89
PID 5004 wrote to memory of 4736	5004	msedge.exe	89
PID 5004 wrote to memory of 4736	5004	msedge.exe	89
PID 5004 wrote to memory of 4180	5004	msedge.exe	90
PID 5004 wrote to memory of 4180	5004	msedge.exe	90
PID 5004 wrote to memory of 3960	5004	msedge.exe	92
PID 5004 wrote to memory of 3960	5004	msedge.exe	92
PID 5004 wrote to memory of 3960	5004	msedge.exe	92
PID 5004 wrote to memory of 4384	5004	msedge.exe	93
PID 5004 wrote to memory of 4384	5004	msedge.exe	93
PID 5004 wrote to memory of 4384	5004	msedge.exe	93
PID 5004 wrote to memory of 1936	5004	msedge.exe	94
PID 5004 wrote to memory of 4196	5004	msedge.exe	95
PID 5004 wrote to memory of 1936	5004	msedge.exe	94
PID 5004 wrote to memory of 1936	5004	msedge.exe	94
PID 5004 wrote to memory of 4196	5004	msedge.exe	95
PID 5004 wrote to memory of 4196	5004	msedge.exe	95
PID 5004 wrote to memory of 2280	5004	msedge.exe	98
PID 5004 wrote to memory of 3760	5004	msedge.exe	99
PID 5004 wrote to memory of 2280	5004	msedge.exe	98
PID 5004 wrote to memory of 3760	5004	msedge.exe	99
PID 5004 wrote to memory of 4060	5004	msedge.exe	100
PID 5004 wrote to memory of 4060	5004	msedge.exe	100
PID 5004 wrote to memory of 4060	5004	msedge.exe	100
PID 5004 wrote to memory of 4344	5004	msedge.exe	101
PID 5004 wrote to memory of 4344	5004	msedge.exe	101
PID 5004 wrote to memory of 4344	5004	msedge.exe	101
PID 5004 wrote to memory of 1464	5004	msedge.exe	103
PID 5004 wrote to memory of 2196	5004	msedge.exe	109
PID 5004 wrote to memory of 4768	5004	msedge.exe	110
PID 5004 wrote to memory of 4564	5004	msedge.exe	111
PID 5004 wrote to memory of 2220	5004	msedge.exe	116
PID 5004 wrote to memory of 2220	5004	msedge.exe	116
PID 5004 wrote to memory of 2456	5004	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://avvocatidinapoli.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x29c,0x7ffbf900c188,0x7ffbf900c194,0x7ffbf900c1a0
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,201777237996728564,5975264689897866795,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11300801798314394067,7759929817424956946,262144 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,6621590345123987064,656873356555122758,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,5147773186615022271,931489405486395678,2097152 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9792107033323104896,4440618450842740647,2097152 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5263139015086826772,7303272784530835720,2097152 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7939981893191793092,8184327316584507179,2097152 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17184457978515905797,12842320012887883525,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,17160207580060825963,7975201596594306811,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5712,i,17207655206535607477,11812310351260014147,2097152 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5920,i,206946722731825097,16201772675308759630,2097152 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7311779406352055970,16365912189099679888,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7311779406352055970,16365912189099679888,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,1168994160171707053,14937463315765424266,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,17678474859912782039,8631070248239447163,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15462409585995225003,1512823661462103993,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,16513277242281066717,3323533788791868897,524288 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,5156830512235515773,10889090289170377241,262144 --field-trial-handle=2292,i,5650619667380150894,2848743996323468853,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 aa0d78ec9cd90e7c6714bdce5235de1fc6b7c3088a6cd8f6e6d2c1cebea7d661
MD5 63134f635628c0af90baed8399868c70
SHA1 0a02b0ee6e4253e3534f292530612cd9f5f16106
SHA512 3c98f5f62643131db7887f04a33b0ca1c1c00b00c63332d61c392e6bf04039e1f5ce53adff3458c5b96f00e8454a916a07ab2c53d268c7a0bedbef781bef81f0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 25KB
SHA256 8475d9c1c2890f6ea0bcb7dfb47075beba14cb2b8233b8150df6adbf62975d4c
MD5 29461b16ac0a4f4a56b28d7c7691980d
SHA1 cf60c6770f8b79fbe62f973beb62ca73a9ca1277
SHA512 26939beac82f33c19d3f654529c2aeb7c1eca03834849c05bb89e2a7650b0e59781a0ab2f384eb36980e84ee00480b8a218921c14bff453edeb3b9f336a326a1
SSDEEP 768:SlnUg2LC41270D2k71tAWYc+gBlK8qA0U:YmG41ok71KW/gU
TLSH
T117C2F1A8A8C7DB86C01F95AFF49D0BB7F7A8921907B1555CF4ED4572E2B60831E38047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 02406325ca0836b82cb1db5c6355bbf7e595f343f245a3e53cf42b9fba8c901a
MD5 3a5ecfcdc895c774f99e5c9c9ab65173
SHA1 038b210f77d99eb409b30acb7eeab49a5d2455f8
SHA512 ba89a51b73b4c3ba729bf070562a578cce1c8209bc74fa45fddd46c9228095a64a1ff265049a06ca4029cb91c65fac2db81b6fe0cfa63490978fd1944ec63c82
SSDEEP 96:YlZfIYCd9UWrFT35uLxXEhtiG/fDR7cIDvf651gHbdlVcM:6QYW9TrFT3QFatXHDJNDvf65MBlaM
TLSH
T1C8B1B8675DD328E1FFB24EB3DED90D28307068EA1A4B2F9325A150BC653F7D009AD129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5888f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5888f2.TMP
Size 3KB
SHA256 6a892dbab2e0cfa0fd5c03b3e84b0925b260de0463724b72a24b80e3f76aecde
MD5 fe61bc98732ef3ecac6b2cdb835a6ab7
SHA1 2515e61437f2f22c070b566951bdb25a1815e49e
SHA512 a46b440783b3ab193bb721e8d8e929e214173bb5a94321c3e7c22d283e0db223d5bb94a4e831c9f0c15fb974b457d5388fd004e43acf318b525fd4dae8db03c0
TLSH
T13E6160472E930CE5F3748FB1DFDA1A383074A8A60F0F2F46105294BD25397249E5E52E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 51e6d57b076182b0f1b12b4c9a520b4b651b34bd8055fe7ceecde6ed3e91b1be
MD5 eae8773a3052a848e23b6e37067e8f0b
SHA1 c4dc3de3a6c397a3add1cb1efe06069d2167179e
SHA512 66febc09709c4083f80d45c47d17e1bdcd74c2e75dec4a8b2e7a3768e708f4425050e31b34ef1d8df50f44a77b85d404ca0a32d8ae8ed5964d6b9bdae2679d68
SSDEEP 96:DOcygXtXa3DpCKyszBpYPzg/LjGXy2G/k0u64+Oq/fH+wQ:DOcyaN8DIKys1aPzg/PGXy2Gc0u64+O7
TLSH
T143C181E39BE8A67DCD2752F0A514EE1BDE180965433C3906C5E89F8FA3F2021D24168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 028c0579d94db8109de8d749d631f18288423c4d5ef7e42961392ed1ade5ebbd
MD5 f0b8ffcc456a50449524befb5e9f4b0b
SHA1 be2b967d766fc9734cc63b251a191fbc8afc480e
SHA512 a90d938cd7bb9148feedb7bd3e37b8fddc9eb5df5676b94bec3e0e892c60393308c2ee11027430a577019a2e52b1da049576319901516eb49a6426919326565a
SSDEEP 192:sxZ2RLyM/jK1Ml8MkW/fBstxNFIdpzGHW6+WN/1D/YHE6WwIgrJ:sxZ2VMW/fBstxN2yHbh/s9
TLSH
T13752E7126A34A977CCDBD30DF9457B53D6F91572A2900E44AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e356e09579440e6519fa0a5278997d8367798686b83e321525e89fea805b4c0e
MD5 1caac130f511ee65a99ec982a409567a
SHA1 e0fb02d3dc4bdcd38c6693f6385550d0db56f692
SHA512 5d0f2db167e6b14db05c3f13d37339222579e118356ac8d054f18cdd38a114978c32d7065d083356891ffe1d8e279c21e89fce275f1140a31c598723c1a69657
SSDEEP 192:sxZ2RLyM/jK1Ml8UQRkW/fBsVQNFIdpZGHW6+WN/1D/YHu9iwIg5VJ:sxZ2VqiW/fBsVQN2EHbh/jV
TLSH
T1A852E7126A346977CCDBD30DF9457B53D6F91472A2900E44A9FCDA1C05E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 31e2629667a404696acc9b965956286004bf51da813c558cf3db9a9b0d76f7b5
MD5 404d836d8000bd72d5c3e1e46a512f4b
SHA1 80a1debbb1b4b6c2511eedfa550dbeae5f8fc96f
SHA512 3dcdd5e54f8a8be9f2c111c8c90c6c49f38df2cebe486ef66c4e9b63fbb857b0e3dacf6316a6a22b548e106a1626476ffba6c785ff08532142c339d9a8af9477
SSDEEP 768:1EUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R2roVz0E:1EUZYTMWvg0Pou1ja7eLZmRNSE
TLSH
T13AD20B3B280CCB7E4F844E9DEC266F967DD801CB5A584D5447EA884C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 608cacdff5281da398acd159d36541e868d71ec8651edef8d363ed03b9c49649
MD5 c15436f5130d31b8dc8cca93ace4c719
SHA1 21d66abfe256bdb72cd2e1a22b0aca37dfec72d3
SHA512 3d79aace45681cdf12ffc467a99a1c73209d9f3f769659fda5d217a719c694f7dfa09b2e71420c210f6ba45de76cfa7f0fd2ad0977bbeec9691c5e8fde041504
SSDEEP 96:KA1eK2A4hqKao060gKdSmnOKAwGyGPKMoe:EMXPoNDf
TLSH
T165D1430231FB16023DFD3A19A2648B2B4742B5633118F52B7BE810B54D6AE345DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2284f965-9922-49ad-ac9f-0b92cff510e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2284f965-9922-49ad-ac9f-0b92cff510e1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cbe9613ec40b570609f6472eef4dc7c880eb3a3313e37be3b1477b2be65c9549
MD5 3d35ec313d29de444ed40d1827a96b6c
SHA1 606d1a6a6af381b46841aee42893bc607d7ea3d8
SHA512 78ff62ec7adf6fad536a215a4e653db19c60fb753059f63ecdd5e48ed1dbf4979e8c2d6bfd977c0790f30ef0311fba89a4cdc90342b410a0b347d5d789661bc2
SSDEEP 384:IsN68e7kfOETHzX5od+2OO+ustJrAxBeRs9JKgqijU3O:IUOw7OTOOnWhAxTjKgqmU3O
TLSH
T1F4725A326828AC77DDE6B685F44736539FF8505BDA806FD0D2DC2F0C019B69C631A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9c9e204cd44c9c3929f2774c66f5b8392c8bda33fe29205088c9ee701c478bf5
MD5 0fbc9093e857beb5ac0c73014cd084c3
SHA1 961b2b328c208f506a9c80bd3516e9ef49402dd3
SHA512 b6216368a1fddf475fe538adabb38a73c03d8017dee59303b9ff4f60af412dac6c75948b24e568f9e74836607ebf65ea71e79af206712a59002cb84820f7e474
SSDEEP 384:JZcIhsN6Ee7kfOETHzX5od+2OO+ustJrAxBeRs9JKgqijU3C:BhMOw7OTOOnWhAxTjKgqmU3C
TLSH
T14F927C315838AC77D9E6B685F88736139FF8902BD6C06FD091EC6F1C01AA59C131A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b866da47bab849692af6149337a078e5f9c9eca7c29896d77dce5cb465c3753
MD5 713b46c2f75b6b11a33a0d49ab738f2b
SHA1 0c9973e5471024b0a8ef6298060d65ca55647b70
SHA512 d9cc8ef5b3c38df7cc356969a9886f48fc6735ef31d068317b915b3d685ccb113e8665218c3ab9a3529e4dc1fe8e886f401352e6ad45d641d376ea262ef3a162
SSDEEP 192:yONC61VWQmiUyrugGX5Obd+j6OuL+7/aE3BcU6:yONC6WTgGX5od+2OO+eqcU6
TLSH
T1D602E835A8286C77CEE2AE49F48737235F99206BEA946F84D6E81B1C009765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b774ae5b4a2dc3980711e9f1687b0326d2f7797af5b9dc18260250c7eb753f1a
MD5 2fb5eef915e7d5552775996c1f44bf30
SHA1 d5ea656532b0d4febaa16bec17dc695c1f090b9f
SHA512 744428e372955f1a7305b2336e3d5ab3a8f6751e4356459d5ddc11d7b212580006f93f4bb124910fb6363deba00075333e1654819911c79ac3dd7217f6c4b0cc
SSDEEP 384:fiFiZcIlzsNC8TUNTUlIlbe7kfOExHzX5od+2OO+ustJrQxBeRs9JKgqijU3C:qFQd7wgbO67OTOOnWhQxTjKgqmU3C
TLSH
T198D219F248D79836D9AE9B47A77E2D134EBCD067F5806A90B3D8590CCC561BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 252b7d569eaba9dc34231d9ac1c60ba2e695c5d24378ccdf0096064f1513caea
MD5 e3cc673a156986863ff0fd403e46e044
SHA1 37d4b199d68aa9061282c88ef2b740a02fca3c3e
SHA512 5f472e2cdfe9fe1dfbdef3af6d0e38bb2cc7b851f8c636bcb8a639fed76f4a9ac014a7afd096d25057d2ab34730b08ce546fe105a468e4ca15c4004c6900cc8b
SSDEEP 192:ZONr61kWQmiUyAu1GX5Obd+j6OuL+usySJrXjJTqyU6:ZONr6V61GX5od+2OO+ustJr1xU6
TLSH
T1DF120A326868AC779DE2B554F48732539EE95067DA857FC0D1DC2F1C01EB6AC134AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f504e629a2cce45d805ae63e333084a23f397fd9ac19f636d8af930198b6a82d
MD5 464e53aaff3e1e60b367215ab44b6460
SHA1 9da035724a3689317104509d47669d7ccfe6d293
SHA512 0d9808f62e8e458a734f932d01c36e97d9d334ac32bd5216de9cf093cc5615382979d908b7c1cbd3b248a866bfac24c533fe88d6b5d9cc2613608e9e3dea7b3d
SSDEEP 384:oZcIhsN6be7kfOETHzX5od+2OO+ustJrAxBeRs9JKgqijU3C:WhPOw7OTOOnWhAxTjKgqmU3C
TLSH
T19E927C315838AC77D9E6B685F88736139FF8902BD6C46FD091EC6F1C01AA59C131A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc3bb989-2f1d-4532-aa67-4a00515e0bf8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc3bb989-2f1d-4532-aa67-4a00515e0bf8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f385f395926a12881116265295949034a7583d1c4f85ce773a15197ec7103530
MD5 d1941c69dc4ae1990643b0f693d86b8a
SHA1 008edc93a7e795b64d58a147f66dcdb58bc7eecc
SHA512 205b6afd9577e1f80c5663c7221d8a898c2048306e851b5be0d028fcc670a7e938f23a409f66e8e6556132713d88a7e0fe68de317e14354c93860c2cc72d179e
TLSH
T19D414859B7FA1108B3B76F5A9BF3A8AE447A79772E06D05E10110D4F0A32B00C872B37
MD5 SHA1 SHA512 TLSH

Submit Download