hxxps://agenzleontrota[.]casa/iyMpkTMzyx/api

Analysis

user interaction
yes
max time kernel
148s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://agenzleontrota.casa/iyMpkTMzyx/api
Sample260910-m41esasbkd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335117209546543"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{2DDAA06D-606D-4375-AC23-F0B8815F301B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4480	3232	msedge.exe	85
PID 3232 wrote to memory of 1516	3232	msedge.exe	86
PID 3232 wrote to memory of 1176	3232	msedge.exe	88
PID 3232 wrote to memory of 1176	3232	msedge.exe	88
PID 3232 wrote to memory of 3964	3232	msedge.exe	87
PID 3232 wrote to memory of 3964	3232	msedge.exe	87
PID 3232 wrote to memory of 3964	3232	msedge.exe	87
PID 3232 wrote to memory of 3436	3232	msedge.exe	90
PID 3232 wrote to memory of 2448	3232	msedge.exe	91
PID 3232 wrote to memory of 3436	3232	msedge.exe	90
PID 3232 wrote to memory of 3436	3232	msedge.exe	90
PID 3232 wrote to memory of 2448	3232	msedge.exe	91
PID 3232 wrote to memory of 2448	3232	msedge.exe	91
PID 3232 wrote to memory of 3724	3232	msedge.exe	92
PID 3232 wrote to memory of 3724	3232	msedge.exe	92
PID 3232 wrote to memory of 1584	3232	msedge.exe	93
PID 3232 wrote to memory of 3724	3232	msedge.exe	92
PID 3232 wrote to memory of 1584	3232	msedge.exe	93
PID 3232 wrote to memory of 1584	3232	msedge.exe	93
PID 3232 wrote to memory of 5024	3232	msedge.exe	98
PID 3232 wrote to memory of 5004	3232	msedge.exe	99
PID 3232 wrote to memory of 5024	3232	msedge.exe	98
PID 3232 wrote to memory of 5004	3232	msedge.exe	99
PID 3232 wrote to memory of 1780	3232	msedge.exe	101
PID 3232 wrote to memory of 596	3232	msedge.exe	105
PID 3232 wrote to memory of 464	3232	msedge.exe	106
PID 3232 wrote to memory of 1308	3232	msedge.exe	107
PID 3232 wrote to memory of 1976	3232	msedge.exe	114
PID 3232 wrote to memory of 1976	3232	msedge.exe	114
PID 3232 wrote to memory of 4216	3232	msedge.exe	115
PID 3232 wrote to memory of 4216	3232	msedge.exe	115
PID 3232 wrote to memory of 1936	3232	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://agenzleontrota.casa/iyMpkTMzyx/api
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8924dc188,0x7ff8924dc194,0x7ff8924dc1a0
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,9363334715624285241,3207461300562996225,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16634663229713096479,1986307871953372881,262144 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,16788397098299789077,11544040576168185224,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,12343659383679179826,6292367131530606219,2097152 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,16098903911204894350,10873410546182776950,2097152 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,11396115573422905043,3864891923873692392,2097152 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,14572910010849467304,11346952511441293837,2097152 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,5384047328936483175,12324733573451458778,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,7638020466737627494,136231925994687602,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4104702552264656122,17742034951903653901,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4104702552264656122,17742034951903653901,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,9581693083655163773,14825884287348746325,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,12703679564223742910,1808109197066922826,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,2093244783518324977,10425989240241889390,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1714089703449793550,1984451780774147625,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,11082341899653595082,17230912097471825796,524288 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5212,i,2385558681163618816,3365944744417593205,262144 --field-trial-handle=2252,i,16367676580850267163,13584441609261608432,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 176746973e5307e57e2f5d9bbdddaec159d2924a802f1c48b5ecc9883fbceaa0
MD5 218e6d3d7228ad9100f6cb73df087e83
SHA1 891519248cc6a756ddc8ae55921fe19b2e60dfb4
SHA512 1f169a2ef0d05166fb28f88d0a09db5a3e36e0a7d8cbfcfdcd1b4d22429188725f7ad3ed29e108f9549b35ca0eb8d1cecc674102f676bd3a77814d4e9a387724
TLSH
T1C07192D4F1759896D3A2837DC6E1C62534349BAB0B8FDD470660863DE50FBE343AE108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5903fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5903fe.TMP
Size 3KB
SHA256 4a7482a871e22b285447dc79bcd9e3ca456c7231170b677c494f1c4a17900c75
MD5 aac6e1c62d471022bf3e36186c5816e0
SHA1 f6388c5d6f6d725f730b212bf050489ff29ad981
SHA512 9e42c4b6cc64081e163f9d48fbd127e1ec925dbfd8a80f8ff2e6e30e8079103c0c1122c22fabfebb61fb998bd8cc0d8701b0cad5b530085c2269ee111f2ff308
TLSH
T19371A3D4F1759896D3A2837DC6E1C624343497AB0B8FDD470660463DE50FBE343AE118
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ea2623f51e0b74048e6ff6a0f8a27ad37e9db90090bb93a9e3c267c20cd425eb
MD5 03a97e423d3ee9b8ebc22cd0c54c6724
SHA1 ae9f1935fe7c81fb1cb9a6a5c7717878d811a53e
SHA512 31bc7e9403ab0eec06df1b59121f49b39f173f4a677104e1cf9c2e18ec42a91b4c4e1b49a078805e53578acda494f05778d20a3d8177a65c8d027d46cf8c33bb
TLSH
T12E2189F3C6D5866DC90256F06A24AE2BCE1D0A45431C3D0989D8EF2B93F2471E10755F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2c838c1bca4459dbec93de892e505a24ea192e833a60a97f001812e8b2938b7a
MD5 f6a251fd7945256613f9d3d938d8c027
SHA1 45d907d1ab5d020a8f40762007e4881fa2532a2f
SHA512 931c462195547bc1d39cba170dd5006aa2dbd205892c37c938bdc80d968c4bca33060ab026a895709b2e7e011d5a912006394a8968ab0537d9cca96e6c6865fe
SSDEEP 192:sxZvRyyM/jK1Ml8UQsWy/fjshg7IdpuVHW6+WNVd5O/YwvILHCIg5aJ:sxZvAqXy/fjs6kCHbV2/sik
TLSH
T1A152F812AA346977CCDBD209B955BB53E2F5447296900E48A9FCCA1C05E6BED321381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2ebe7aee515e54939830803dbceecff5ff5ecbdb711457887360c8689af5594b
MD5 4bab16ea420b6bf671cefcf22335b08e
SHA1 1b9f77fd4da41ec48fe0398150d1510838502937
SHA512 619bda5c4f02fb2bee49104827b069c44587377e0a0b977e3eda38955b210c07ae6ba15654b88a9a87672129ff5d94d779a764574b81d6cd7a00f6d9e17b4dee
SSDEEP 768:WX4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dFrohFccaj:WX4jeXmWvmKLEu1jacPLZQd+c7
TLSH
T192D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4ff05ebcba9d62c8d09b27e2c0b77a83a08da17a18b2c7807279e712d083119f
MD5 060aa69e5cc0b76eb0e5230e2fbf9e9a
SHA1 1d4360328995471871a4ea8edff5ce194816698c
SHA512 54c4668f89c33f18e5d8246b1cb154dba65c1335f45241a1d9db536381c236763b19a914bf1b433c27ea60cc7c55f3160b173e0bf97a1ce092e4a360e51d1bd7
SSDEEP 96:KkHC7ntll+n1AldH+KFLdB+pfHoxXfm3uKQ41BUlRf7vgbD6zZZgKR1Z3gVpZqXA:zHC7ntll81A3HHLdBwfHoxXfVGBUlRfG
TLSH
T176916052327F42023D7E2908A695D76B174271B73108A43B7BAD01B24E6BE281DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1c14499-1a89-4e9a-8437-8e56a1efe230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1c14499-1a89-4e9a-8437-8e56a1efe230.tmp
Size 12KB
SHA256 10feca9c156fc7921a5f96c0f501316c395f4cc931a755e70addc84318bd5b4b
MD5 7922c1a1cc96b7b31a6be66a45fc23b9
SHA1 55f1ec81abf4c3a90942b1882d0acda289c991ad
SHA512 5470d78fb956402246ab99f3ca010512a84c8ecb3b298f26e08eebe2d89d4094c614532dfed8c85579e655fcc4988a4e0c48b96b79fad6f82c362e6f53d1942d
SSDEEP 192:sxZvRyyM/jK1Ml8MWy/fjs9g7IdpgVHW6+WNVd5O/YwxbFCIgrJ:sxZvAuy/fjsWk0HbV2/49
TLSH
T1B2420912AB346977CCDBD209F9557B53D6F9447296900E48A9FCDA0C04E6BEC321381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

341a8294-7e88-4e1e-b197-a90c38802cd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\341a8294-7e88-4e1e-b197-a90c38802cd1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 07bbd2b69b6e502de81da8ada09415d9622fb8509afa1e89b101d30cec0a8f53
MD5 34d0a52681e49fef4be8eb42cb58733b
SHA1 d6dc30857772470e881dc97dedf9c699d89aa878
SHA512 87ab0e0f7017710035f6cc33476788ea086d47170e6a99e96029e29b6b240b0b0012e312e12e82d445bc58922b947e5dddb6adb803f61b7e3273bb23ab95b28f
SSDEEP 384:3ZcIhsNge8nrkpf++BO1/cdFUsa+VYooJ:/h4RTBO1/c3Uhgz6
TLSH
T1E6827D326D789C765CE3A281F94B36035EF491279AC86FC896EC6B1E04CE79C2307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2adddd75c6e2271403d61cce4c5551a4ccd27ba72faf99718b8c246f9256b7ed
MD5 0a5cfdd0bb4e1982c6bcbe7889de839f
SHA1 db65c819a70ba1084471eee9996635092332da3a
SHA512 3d8bc91e336ec0e24d58b0661c3a11d029649be541d4fe90e451791e50f797180dd47a79553c697b5ea7c844afb1658b8e9d8d54fa8b9ce941cf4288fe09b0bb
SSDEEP 384:6iFiZcIDsNg8TUNTUlIln8nrkpf++BO1/cxFUsa+VYooJ:xFQDlwgFRTBO1/cLUhgz6
TLSH
T184A26B335DA8DC7A9DF69B85F94B32139EF44167C9C9AAD4E6DC6B0E008A2DC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2bfc6e4409176c280b6edef0de54f3e8235492e68a0a021255af3164e69506e4
MD5 2c1ca1282494f24e26146ce4056d80a2
SHA1 e8d340d751169c248d723536ac5d75377e8ed16f
SHA512 6ab721e2dc523ffac8fc4189cbd85c436b652708585ac1cf56ada3b1e22655eb9a2ac5f8b58809613cf1c8cd562055c1aed6eec5b85f67e84ed329313afeaa49
SSDEEP 192:EONI6hZ0QmiUy24pc/+jVEBO1Tm65wOZngfrU6:EONI6oapu++BOU2gDU6
TLSH
T13902D935A86C6C778EE2AE45F48727235FE4212BEE956F88D6E81B1D04C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 03d46cee30b5b8a7bfdcfbdbe5c10878268d1b5403738f8cc1438afc0163dc9b
MD5 04554bec5e20a5438465ce7ad433de3a
SHA1 5ac4376bf324f7f0133091e9ea134028db64038c
SHA512 bc264dd9cb843c85d74b61c9ac3811452d839df5e35b72730a38369015079a951d3510aaa386f42a41af2cdea1bf05f7a53491115b21ce970e3d33fbe6671033
SSDEEP 384:8ZcIhsNgn8nrkpf++BO1/cdFUsa+VYooJ:qh3RTBO1/c3Uhgz6
TLSH
T17B827D326D789C764CE3A685F94736135EF4912B9AC86FC896EC6B1E04CE79C2307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88eb12247b4e71d7dc3f87c5e5f1530487b3bfd4f803e78cff069443cc3eaba8
MD5 b9ac85ca1e387fc4f5460936445f5cc2
SHA1 4c3696c7f57702b3744157a0979633b04345c3bf
SHA512 8453c55c46ef76036b417999df0797bdf289af2923d0276ea64e46aa43cf0cfb63ed599eafa4f11cb3f4e82f4f04c9e331b295ac796a6b3408ff9188d99f60de
SSDEEP 192:DONZ6hZmQmiUyU4Lc/+jVEBO1Tm6//EY5cOqkq6U6:DONZ6GqLu++BO1/cD9UU6
TLSH
T15D1208326868AC371DE26981F48736535EE4512BDE897FC4D6EC2B1D04DF79C230B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bd55612-2adc-4063-ac4e-d71409683859.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5bd55612-2adc-4063-ac4e-d71409683859.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d6adea736bc8b0e134dacdda37c8d83dd30396917220580432fb368239f8c51b
MD5 4aa6dbe38a58b53d9fa73e62acfdc07d
SHA1 4c984c5dc930865fc7482c8b632aa42b4ddf540f
SHA512 63b4182a037abd77e0d4f1f2bffbd053a791eb146f167fb8e921ce4e16fa1a6ee87d52cb50c6200e512921d34eda5cea3fa47e357afb08f11b5a4cb212d2ef3e
TLSH
T17E412A5CA6EA1144F3B76E5A9FF7A96D487AB8372F06D49D10110E4E0633B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download