hxxp://agenziaevntrate[.]cfd

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://agenziaevntrate.cfd
Sample260818-pl8dsabj5w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2600	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315295804304867"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{2772F1AA-9E94-4F02-AAF2-6B2B15DA4588}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4332	3548	msedge.exe	85
PID 3548 wrote to memory of 2600	3548	msedge.exe	86
PID 3548 wrote to memory of 4048	3548	msedge.exe	87
PID 3548 wrote to memory of 4048	3548	msedge.exe	87
PID 3548 wrote to memory of 4048	3548	msedge.exe	87
PID 3548 wrote to memory of 1224	3548	msedge.exe	88
PID 3548 wrote to memory of 1224	3548	msedge.exe	88
PID 3548 wrote to memory of 2516	3548	msedge.exe	90
PID 3548 wrote to memory of 2516	3548	msedge.exe	90
PID 3548 wrote to memory of 2516	3548	msedge.exe	90
PID 3548 wrote to memory of 1512	3548	msedge.exe	91
PID 3548 wrote to memory of 1512	3548	msedge.exe	91
PID 3548 wrote to memory of 1512	3548	msedge.exe	91
PID 3548 wrote to memory of 400	3548	msedge.exe	92
PID 3548 wrote to memory of 3920	3548	msedge.exe	93
PID 3548 wrote to memory of 400	3548	msedge.exe	92
PID 3548 wrote to memory of 400	3548	msedge.exe	92
PID 3548 wrote to memory of 3920	3548	msedge.exe	93
PID 3548 wrote to memory of 3920	3548	msedge.exe	93
PID 3548 wrote to memory of 3420	3548	msedge.exe	97
PID 3548 wrote to memory of 3420	3548	msedge.exe	97
PID 3548 wrote to memory of 3420	3548	msedge.exe	97
PID 3548 wrote to memory of 3528	3548	msedge.exe	98
PID 3548 wrote to memory of 368	3548	msedge.exe	99
PID 3548 wrote to memory of 3528	3548	msedge.exe	98
PID 3548 wrote to memory of 368	3548	msedge.exe	99
PID 3548 wrote to memory of 848	3548	msedge.exe	102
PID 3548 wrote to memory of 3516	3548	msedge.exe	111
PID 3548 wrote to memory of 4604	3548	msedge.exe	112
PID 3548 wrote to memory of 3900	3548	msedge.exe	113
PID 3548 wrote to memory of 4044	3548	msedge.exe	114
PID 3548 wrote to memory of 4044	3548	msedge.exe	114
PID 3548 wrote to memory of 5064	3548	msedge.exe	116
PID 3548 wrote to memory of 5064	3548	msedge.exe	116
PID 3548 wrote to memory of 1168	3548	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://agenziaevntrate.cfd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd3431c188,0x7ffd3431c194,0x7ffd3431c1a0
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,9224522335370356020,6189852111886607775,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13353421770619867068,6806189649178941776,262144 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,838739649978075348,10871756625817888204,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,605295268107678578,8609340449471830029,2097152 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,10369300864635679864,9915165025991413072,2097152 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,14057684918790374058,2726061602350570606,2097152 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,1505432440581874418,14845889668492412875,2097152 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3520,i,3101408487492856800,1467660891611950925,2097152 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,16946256148369055094,9890721958399629754,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,6941479740279968692,14704895672576962425,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,4561515094642816694,16747133365193014071,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,4561515094642816694,16747133365193014071,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,7881337443017817157,5240904710071185464,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13765578566396651515,12438505622176422436,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14763990914091322887,13958399449285815440,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,8712662953337204418,10102406035373409494,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,1684300246681294580,7492795212892359917,524288 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,15062073374946444823,18064426335690520637,262144 --field-trial-handle=2240,i,1807981427734327206,6113330632438209838,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2e24e08605c7cfca52b6d268d14d7afc67a5d9586b645c6f44aa25690cc0e303
MD5 4f4cd3ded1d1752b942c3addbebf89ca
SHA1 5fc0017fc251880a23bbf0593cb282f9a57583a4
SHA512 97c207a1b02c7e1049bb472d38ca09950697a0b231fe72a08ac3be1dbffb50841a7a605c2c037794a7e6a9554e1f3c8a08fff73a8459871d52d522effc66ac0a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1f135fddd548836070e3ff9003143fa933ef2039059f3bbda16dbd3f9fa2f641
MD5 c78f9c3aabb4be6f10b83451be7fa76d
SHA1 319c081e12ff2a22120bf2d9929d3d5493e9a054
SHA512 57c141142147865e6f17fc57cc0ef2eff5bfd02876ad23c4f31c05ffdaade30bdc34687b6003acd9edd5c69802aaca9c1ac288f8a07e1349813c93a0786f6b45
TLSH
T19561D4386E0384A0D393E1B3749242E030658AFBF416DAB6C02C1860261772FCF1703D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 70d3a3bc5b1c9022e3c5712b00925401012fce13a5f2b2d89fc98481da854128
MD5 550d2522a19ed381894896537133979d
SHA1 f27facd7fad2ddeb59737f1064ea21aedf969f00
SHA512 93efd750922878f18b965b004268f750c5d4fb1ced6a703aa4bb4bf745131b98ebff2cb227c8099b763b1f1c569d4cdbec34eb7aefaea83d90eeba912c8c48b4
TLSH
T1A431ABB2C7E5825DCE1122F09A24BF2BCE1D0964836C7D1AC9D4FF1BA3E2070E21254B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 af20b6b9cf74a47fdb8d3dc0f5f7326c6706b4f2427aacc49a952e9ef7c238ec
MD5 c40c1f730dfa730d4cbcaaf196579ba2
SHA1 3e5f0a3c553d4d9ef116544d142990673bb7831f
SHA512 249fdd17976eeace8b7f4d0ce2bf8222b1b5baf92a79fe2d013a4e4f801f9c6fdb1f668fe4424e7e04c3931cd9cc8f1429926ad6a27748cd8b408aa814d6c74e
SSDEEP 192:sxZaRKyM/jK1Ml8Mk0/fAsWPuIdp0AHW6+WNV9+Sw/YCe0vkLIgrJ:sxZa0M0/fAsWP/RHbVNw/3Y9
TLSH
T18752E7167A34A977CCDBD309FA55BF53D6F9447292900E44ADFC8A1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 891bf624b12f6099983355882342b2bf2b28bb6cda9c697cfdbdd4d68381d8c9
MD5 b82c1135c43c343446e80d7920935c07
SHA1 8a04321851b89ab7a32fce891d34c103339b3087
SHA512 da2fb2b9429678343010a730a9649ce6662020c321bc2684bbaadbe0292904ebe060b8ef42c0d2fcef1028d1f1b20916ae3528f7c6524654f7cfa145f5f8ebb8
SSDEEP 192:sxZaRKyM/jK1Ml8UQjk0/fAs+6uIdpOAHW6+WNV9+Sw/YCGFHekLIg5XJ:sxZa0qI0/fAs+6/HHbVNw/weYz
TLSH
T1D652D7167A34A977CCDBD309F991BF53D6F9447292940E44A9FC8A1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f8aad9551ae62be377d19271d70727f15494da42ee085bb9e043238be5bbec23
MD5 07f3df50f5582b2962e0c002189fe151
SHA1 406ea315e44b02c979f6e52adf3c4fbed7daba5a
SHA512 3bff05e0a3e0c3ce609175c25859a9b4ae85e46f070dcd6cdec53826ccf297244453eba2609ffc531a7ff26ca5779a7574c217dca0fbd22baab3938bab263d2d
SSDEEP 768:rU8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVcrou:rU8bqn+WvSCt6u1jaCZLbWVHu
TLSH
T154D2FA3B280CCB7E4F845E5DEC266F966DD8018B6B988D4447FA884C03C76EB512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d6826ba34d9e5fed1abfb93f11dc3247f8aadcd568bfb8f8d84a6a270a4bace8
MD5 b120499d60a777bbb3d4dda952807744
SHA1 1c0a6471239d6f81d307046b39337a76cb0c41be
SHA512 223db9ea7939065462d065d25fd2579b24f4dcc8857ad0f5c7178e371a9edc263be2b0d79015042dd3d0db5d4c49e6fdd3ff10afdeb2df0070582aa4fd79bec6
SSDEEP 48:K4/IhKkosty1hI9KaIg6DIJKEAUnyVTIBK8osg:K4/6KkocOh2KaIND2KEAmuT2K8oz
TLSH
T148C13146F03B320238FE65089795A6369E5171637819A46F3FB801A21E77E121EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b626792-6445-4240-8677-1be2576562b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1b626792-6445-4240-8677-1be2576562b9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f206b51f47af180a0d8a73ebc7798a64e70a7c769e55f95ab86a2a928499166f
MD5 c6cbb7517cdd60ed5a0f7393248a09fb
SHA1 ac52d0024edd3c9a0da3205e096f2e7265103059
SHA512 02fc368dc127bec532ce08871fed6ad42231c470a297028f932f340fd8d8a6c6b1fe9f1b633002b23b7994be38fc9498e1d369d70948fd8fdcac62ff86f68476
SSDEEP 384:kiFZ3yFaeO8PsNI8TUNTUlIlE201SeQ9Ea+1OAdOr2Yq9m6BMMj5ksAu:/FZ3IzhPBwg3uasOAdOaX9m6yMB
TLSH
T159A26C376864997BAEA66B45F94B3213EFF0806BC9D57AA4E6CC5F0E00CB09C130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 34a50b1123023068bec2d7cc10db2b1212a4c20655b6f906af3571abde16d15f
MD5 389f551cc26474f50f5e4c51f915e5de
SHA1 624c60c878ff5ab04617aff6b65ed32fad5a4b75
SHA512 ebce7a4beac7ffa08bf4c6ec7dbe2b1febb9caabd176f195847c1712fad5c550f0d4b5e8a82fd3ef7eab7f0fdc35cd1aa619943c0b688553ddfc27e7f7c13d1d
SSDEEP 96:EqONkeQsjpf1bxX5ih/cIPURHl8h4otop5wnDYBfPgvE5BzatIRdy+ZhOmGsR1oA:vONa6Db6QmiUycsHBa+jBOmBRGRgIaU6
TLSH
T1AA02D73578786CBB9AA26E48F88737279FD4103BDA966B94D6D81F0C00D765C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c5fbaa2d311d57b66b3d0b8e4e537123016297e1a2cf3899aade81324e121b0d
MD5 76a9392965a8fe6b12f35efd3159d176
SHA1 62a7343ad5f4081ab8c052810b22f2b68a8d63cb
SHA512 4797c6b4445ce164050b085cf17b0fba7af0c16737351b71427be8e54c82b1662f019763645cf68fc5e8b62acf361be90a0ab9a8acc0d91be612c8e271ab0103
SSDEEP 384:A3yFaeO8WsNYG201SeQ9Ea+1OA0Or2Yq9m6BMMj5ksAu:A3IzhWruasOA0OaX9m6yMB
TLSH
T1F3928D3B78385D7BAD92A645F54B3217AFE4802B86C93F94D5DD6F0E00CB19C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bc4e67bd3b028fa15a5b666f8d2b5fd59ef532ae129ce2eddeec7d60194172a3
MD5 3dfae09c7a28be4424e4a0461553f463
SHA1 7643f07b04f67578bf45334324325eb200e50e49
SHA512 697e3dff03d9de3fb23f8dca8b64eb1689ea748d3172ceb9dc6eaed4be8ca02c153d7c6909c12ed9242c3eae0d468574fedb31bd32c1eaeb6c28e3db33de2f77
SSDEEP 384:43yFaeO8WsNYE201SeQ9Ea+1OA0Or2Yq9m6BMMj5ksAu:43IzhWtuasOA0OaX9m6yMB
TLSH
T196927D3B78346D7BAD92B645F5473217AFA4802B96C93F94D5DD5F0E00CB19C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83559133f2e7f75aa1bbcd08ae983488bc3c330cfd5178f0af511c499d81f51b
MD5 24a46e1f59be3f464bfa974b6aa5c77b
SHA1 ff1d7d88c7d2a7bd73ac028ff6cbefaf93464b29
SHA512 072e0f17c7487c343fa590645bffe506d68f3c97a336e1b4873220b515c1b785b42b88c35fe9bf16dcb56e499614f0403074365de6bf1061a3786ec7ba89e78d
SSDEEP 192:kONJ6Db4QmiUyOsfBa+jBOmBRZWM/NzSq+U6:kONJ6QQfBa+1OA5OU6
TLSH
T1EC120A36797C9C7B5ED2A644F88736139FE4812BDA8A7B90D5DC2F0C00DB65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a377f09-9738-40a6-8fd2-cf971c0a5832.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a377f09-9738-40a6-8fd2-cf971c0a5832.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b069b79fd512e350856758041c9f7e82bfa25ad082ff1a066c9e9fd7f674296c
MD5 a1994beefe92242734ce29332995cd2b
SHA1 9d2106aa61711e4181e6149477656703cf1a5f2d
SHA512 ba2505fe1efc47426368a3ad57be111d80cbfa64132d972f30397f6bdfab55b5a4c9e041e24ae13df4301648701bbe63de547acfa169799d8a7c405186b34b6f
TLSH
T16A41185CBAF91148B3B7AE5AABF7A46D547BB9772E06D05D10110E4F0663B00C961B33
MD5 SHA1 SHA512 TLSH

Submit Download