hxxp://agenziademanio[.]xyz

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://agenziademanio.xyz
Sample260821-pvlalsen21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317895518011705"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{A6747D4D-F982-49E4-A30B-F620274D36CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3120	2332	msedge.exe	87
PID 2332 wrote to memory of 1172	2332	msedge.exe	88
PID 2332 wrote to memory of 3920	2332	msedge.exe	89
PID 2332 wrote to memory of 3920	2332	msedge.exe	89
PID 2332 wrote to memory of 3920	2332	msedge.exe	89
PID 2332 wrote to memory of 3732	2332	msedge.exe	90
PID 2332 wrote to memory of 3732	2332	msedge.exe	90
PID 2332 wrote to memory of 4892	2332	msedge.exe	92
PID 2332 wrote to memory of 4892	2332	msedge.exe	92
PID 2332 wrote to memory of 4892	2332	msedge.exe	92
PID 2332 wrote to memory of 3716	2332	msedge.exe	93
PID 2332 wrote to memory of 3716	2332	msedge.exe	93
PID 2332 wrote to memory of 3716	2332	msedge.exe	93
PID 2332 wrote to memory of 440	2332	msedge.exe	94
PID 2332 wrote to memory of 440	2332	msedge.exe	94
PID 2332 wrote to memory of 440	2332	msedge.exe	94
PID 2332 wrote to memory of 4388	2332	msedge.exe	95
PID 2332 wrote to memory of 4388	2332	msedge.exe	95
PID 2332 wrote to memory of 4388	2332	msedge.exe	95
PID 2332 wrote to memory of 1160	2332	msedge.exe	99
PID 2332 wrote to memory of 1160	2332	msedge.exe	99
PID 2332 wrote to memory of 1160	2332	msedge.exe	99
PID 2332 wrote to memory of 2176	2332	msedge.exe	100
PID 2332 wrote to memory of 2176	2332	msedge.exe	100
PID 2332 wrote to memory of 2176	2332	msedge.exe	100
PID 2332 wrote to memory of 2620	2332	msedge.exe	101
PID 2332 wrote to memory of 2516	2332	msedge.exe	102
PID 2332 wrote to memory of 2620	2332	msedge.exe	101
PID 2332 wrote to memory of 2516	2332	msedge.exe	102
PID 2332 wrote to memory of 4708	2332	msedge.exe	104
PID 2332 wrote to memory of 3740	2332	msedge.exe	118
PID 2332 wrote to memory of 3292	2332	msedge.exe	119
PID 2332 wrote to memory of 1288	2332	msedge.exe	120
PID 2332 wrote to memory of 1000	2332	msedge.exe	121
PID 2332 wrote to memory of 1000	2332	msedge.exe	121
PID 2332 wrote to memory of 1692	2332	msedge.exe	123
PID 2332 wrote to memory of 1692	2332	msedge.exe	123
PID 2332 wrote to memory of 4380	2332	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://agenziademanio.xyz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffedc9bc188,0x7ffedc9bc194,0x7ffedc9bc1a0
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,14684618405335563039,16729561166854103096,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5467110153843839811,6017050844564450050,262144 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2626040885737559859,11951624649805159238,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5193232005620507556,1743735497216511608,2097152 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13746572215934884862,14332561305818798077,2097152 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,4456990052547407323,7883037860243857466,2097152 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,3584760883508277800,16837622322606547724,2097152 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,9579775336501062325,17177285226751483703,2097152 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3544,i,1694721436863072331,2867619002748786299,2097152 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,1546192314655364064,3032494225263605169,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,7794818561555477797,9916208082979172142,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7540197449243820070,13770594111752124453,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7540197449243820070,13770594111752124453,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,5757350226350780261,12266800916107840355,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,2055820637131899481,848020243887357716,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,17919472638032624092,15509724211573301011,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,13703003830269514311,2590966020757625536,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3712797741199278862,18118315178130737489,524288 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,12668346505099060865,904805233527382857,262144 --field-trial-handle=2392,i,6627062593233902011,9467103417480606127,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ef8c8fcc541d33d05edaa03960cf899f1d6d3f63aef57ee3f2f79bd98729e780
MD5 2c7bbce78bccb5d33d8e8a8d1c65b4a7
SHA1 78cee4085ff3bda26ba81240454d50c6202d98a4
SHA512 3e32df7e99dfe6eb7a6093dbc2d5c4578c33e6546c33761428cb779424208643ab23905d02daac4fa924d69b0b792ed34c38229dace99908896404d3b06c1b80
TLSH
T10B7181386351B08CDBA121F275D30E56B07AEAC0F9E7DFFA2B53A070DA1E7AE4404650
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a0cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a0cf.TMP
Size 2KB
SHA256 7a261a14ca4649f57e10a3ab149761cbd16c3a5ce18cf9710e4cd5e5205c2eca
MD5 d7269f7a1f94b75e30b8d97171df65b1
SHA1 30ac6ab963b11b393f4cb21afa052fb61216b596
SHA512 144d3bb1ff65393cb93a60dbf2c60dbf63522d6274fae4bc4a572149a327802dcd7b712ac976bd11490a5937ae42552182929852fb99e0dc2a15e9b9b1f81594
TLSH
T13651B3384702345CD75900F1B2D30CA6B0BAB6C0F9E7DFFA0BA3A475CA1D7AC8814654
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 48c8858dd0ba1a03107e241c45e51b783bd10123b56faef8277621b4d706f59d
MD5 1a7e93f2282a051a08874c369a18685d
SHA1 56399a3a0bc3297b55fe72fb9b75c754f8cff7b5
SHA512 a5cddbceb83693e58e09b1c596db94593f9ac6f853930f85615500008476492cd6272a851ed6b15e42b284a2c647c4436d8346f5c5f6d0e760261775ac4f4259
TLSH
T12C318EF783E8866ECD2152F0AA146E2FCE2D0925431C3C39CAD5AE1797E2572E00169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c8a34eec-6483-4103-bf5c-8f142ddbf29b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c8a34eec-6483-4103-bf5c-8f142ddbf29b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2fdc36e44a763986d48222bb3eb674a0c769eff6438502b6b2abd2622bacaa04
MD5 15b070797f59520e16781c6b2e64b2b8
SHA1 03f4cb9a8ff81b4d6bbf1822a449979912197d43
SHA512 c9718cd5a695b0894d46411749757d2d414600c16282ec40ccaa5b55ee9936ba5678d376f31035cde937a029b6244715d349377673c73c22693aa5e641d7a014
SSDEEP 192:sxZgRuyM/jK1Ml8Mk5/fxsqex3IdpwkPHW6+WNV6GVwB/Y9Iwf1sIgrJ:sxZgUM5/fxsqeOpHbVRS/B9
TLSH
T14B52E7126A3469B7CCDBD209F945BB53D6F5097292910E44AEFCDE1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6ce1885b96395e289ed79b8e4e2c1ad0234eed8bdc2fd99f6be861b010b9a7eb
MD5 31ba01215c367be96f85a05b84cfd067
SHA1 ac9d72b9804dc2f748204d9a6c765fabac9aac00
SHA512 a10d0009ed47fd03bfad86e4227f2be0707b66c1c204c61ef9321617a84cc976e4f6f7b054ef98b8ed59a905842f30a62c2aaeee83f8aec34ad647bd71f7fcd2
SSDEEP 192:sxZgRuyM/jK1Ml8UQ9k5/fxsqCx3IdpWkPHW6+WNV6GVwB/Y9Ife1sIg5KJ:sxZgUqW5/fxsqCOHHbVRS/pU
TLSH
T15F52D7126A345977CCDBE209F945BB53E6F5087292910E44AEFCDE1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 599d7ab1f1bf1450ab8ff31f0dd4169ee538bb8fbc95f613ca1d515961ba9775
MD5 5c49abea1999509b117a8d14f43f1218
SHA1 5c6f2e33dd1c29260f9369d785f6bbfa40eb01ca
SHA512 7c714efa8bcb1b6756b4f2ea74cc7f869d5af7603780652ef8998b8c037be05eb9ebd37f88bc49641b1271a3092037fdccba6ee3c2b2395b2c9c4e5a90ea3acd
SSDEEP 768:8hcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN/ro9lg6V:8hcv21wWvu+Z+u1jaeFLeRNsLF
TLSH
T182D20A2B280CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 60b68346648b28fc85ed120cd974e3b3cabaaf4628d215488862cb392d8420f1
MD5 8ab5cc40acf187dc62fe5e5415a2ae5c
SHA1 ce5281aed1d3b1ebfb4a4cc972767d3da1345c52
SHA512 da574e424e50871b5075590d827bfad4e6021e9549c18940c1ac9d13b7fa37f38587407692dda310eb92794a7313d2bf92fcf649d9b676e839c1a92ea6ab37ba
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+HyKokuK2EKnqPJ:mThJ36
TLSH
T138915212713A0282387F785CA69687375E4235933518A87F7FB845A14E27E117DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c82fe358-d6cd-443f-8f7c-34f0a69c1c5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c82fe358-d6cd-443f-8f7c-34f0a69c1c5f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f20a2d4bb00b6e1f85df4d622b1dffc129b1c0d8e65286b65cc262b3fcc35d94
MD5 b702dc728c2b832497c08d32a6be5e48
SHA1 9738a0af81508430c9d887e43017d3517ffad917
SHA512 05e0a8e2bd855cfa00f7bbb73ff289c57545dd81d7e7d9d1a5f4c2b52e81172fe1120c440b35b66c80a51b3182a32198abb186a0b636afab4abd84cd0aa56a69
SSDEEP 384:yiFiZcIDsNc8TUNTUlIlHJtTziGhDe+CnOqEl4b3ivW5o7:5FQDNwg9vxi/OHlK3iOQ
TLSH
T11EC23AF258E7487AD9AD9743E73E2D038EBCC063B585A940B7C85A1CCC961BFD306821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fc900b6f94eaafe53a77ab47cc0a4adc469bdfe795485943b9b6b494bf4398a9
MD5 feeab9a5f4a4de210c0fab701181bd3a
SHA1 990bc6f34c37a95a1c620d758a0b1c03bc22086c
SHA512 3f272bc149b5ba268df194b3e9ee45fd94ed4c174618e337abc14e370d0063df95f9f5e2760b803329c2e65392b897e99f03fa5139a5c72a4cb87aa1ab63927b
SSDEEP 384:7ZcIhsNUVJtTziGTDe+CnOqEl4O3ivW5o7:jhtvji/OHlJ3iOQ
TLSH
T1BA828C716C385C7A5DF6E241F94736079FB88067D6CA6F8095DCAB2C01EB6982317837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b318fe225aadc71ed0c080eff6c0ea2dd1bfd7e80faff13ef1db9ade9be58c0
MD5 73ca7514c1b35cc04d3eb34024abc672
SHA1 46fbc822bebc35ef9009721f592a99aa6eaaf644
SHA512 e406cfef6bb51c5750d64be3a9c210e628f674cd7f3fbdf1fd2cf011d98287ee36cb2e885a5bc446aa6a02cd2b77298213d807178f72ca7c2e74fef4609970db
SSDEEP 192:JONt6v+YLNQmiUyG9Zh+CGVgOq8us+T7U6:JONt6vz/lZh+CnOqy+PU6
TLSH
T14302E935AD782C7B9FF26E45F98737176FA8217BE9922F40D9D82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 129831f88b0305855f435398ae05e90cf2943cc7dac5cdf3879a2894fc0dc385
MD5 24ab65143312542a2f74553c673d1da0
SHA1 81d91b54ffeca7dbff00eac06a19dd85fb484332
SHA512 423b762d40fdbb805236d5aadb94403ad5b76c741b380f90dd8215dfd7b7ace900ad6d256a6fdeb81b177069c0fdceb69533bbaeab45d8d96adc30a0bba9a436
SSDEEP 384:WZcIhsNUHJtTziGTDe+CnOqEl4O3ivW5o7:Ehzvji/OHlJ3iOQ
TLSH
T125828C716C385C7A5DF6E240F94736079FB88067E6CA6F8095DCAB2D01EB6882307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83da20805aba84ae6c67f0513a1cfa5876397ef47ec30586bd844536675160fe
MD5 5c30cd85b06bd10a446e641d5134ac88
SHA1 97db03877381597f2af8ff410a86c16ed80a8814
SHA512 fb6c0b6b835d92f0c653bb7ac7bb7cb35e463289e36f15b582828e78b3edd78a59d42a784fa20cde9667f9991b5a2e676c8f18626364d63a47ef29777d05109a
SSDEEP 192:mONF6v+YL4QmiUyd9Rh+CGVgOqEl4GCHqqPU6:mONF6vz0kRh+CnOqEl4H3U6
TLSH
T110121B32B8785C6B5EE26545F88736135EF9512BEA867F80D5DC3E1C01EF65C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaae2378-57a3-4e6b-b11a-708493a2be70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eaae2378-57a3-4e6b-b11a-708493a2be70.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 05af31cebf71a611167512a5a930000180a0148549c9e84a348d73288fefd496
MD5 d3d12d9ee9a9fcb45c39ef664929f22e
SHA1 06781c1cca27c79993aa6ccbd709071811daca5e
SHA512 32119269e0fb855e70283a5cf89dd3b79d2c597fbd34064003fa2e16c5d2b0360223ac14cee0e4a15d6e3c140818d6fc331f085229d5fabdaadd4af5a4f5338c
TLSH
T11141055CBAE91108B3B76E5A9BF6686D587E79722F47849E00110E8F0A62B40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download