8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/__MACOSX/api_olivetree/application/._index.html
Size 222B
Sample260729-xmfddsdc53
SHA256 8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c
MD5 b1ff28ad21b92cf42f82786c95985de6
SHA1 2e2d4d82a1c8831959af1d85a10c0a811e5701a1
SHA512 02ae858beaef74edfc017837ace8e711c10e9e6b5b66db3cf8bd1b08168c3ec42444658a5c78cf2ab6b08cdaf42fb8bc49f36dabab83f566c28adaf25191a129
TLSH
T1A9D08CF021141D46DA55C2F22986A8D02B36B4B4C2671377744EA0403B40A51B7F0307
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298251791087286"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{1CACE4CA-3E6E-4CBC-AFC1-62110B5828E4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1844	4204	msedge.exe	84
PID 4204 wrote to memory of 4380	4204	msedge.exe	85
PID 4204 wrote to memory of 2520	4204	msedge.exe	86
PID 4204 wrote to memory of 2520	4204	msedge.exe	86
PID 4204 wrote to memory of 2520	4204	msedge.exe	86
PID 4204 wrote to memory of 2308	4204	msedge.exe	87
PID 4204 wrote to memory of 2308	4204	msedge.exe	87
PID 4204 wrote to memory of 1784	4204	msedge.exe	89
PID 4204 wrote to memory of 1784	4204	msedge.exe	89
PID 4204 wrote to memory of 1784	4204	msedge.exe	89
PID 4204 wrote to memory of 3384	4204	msedge.exe	90
PID 4204 wrote to memory of 3384	4204	msedge.exe	90
PID 4204 wrote to memory of 3384	4204	msedge.exe	90
PID 4204 wrote to memory of 5000	4204	msedge.exe	91
PID 4204 wrote to memory of 4804	4204	msedge.exe	92
PID 4204 wrote to memory of 5000	4204	msedge.exe	91
PID 4204 wrote to memory of 5000	4204	msedge.exe	91
PID 4204 wrote to memory of 4804	4204	msedge.exe	92
PID 4204 wrote to memory of 4804	4204	msedge.exe	92
PID 4204 wrote to memory of 4388	4204	msedge.exe	96
PID 4204 wrote to memory of 4160	4204	msedge.exe	97
PID 4204 wrote to memory of 4388	4204	msedge.exe	96
PID 4204 wrote to memory of 4160	4204	msedge.exe	97
PID 4204 wrote to memory of 2336	4204	msedge.exe	99
PID 4204 wrote to memory of 1244	4204	msedge.exe	103
PID 4204 wrote to memory of 4460	4204	msedge.exe	104
PID 4204 wrote to memory of 3604	4204	msedge.exe	105
PID 4204 wrote to memory of 2964	4204	msedge.exe	106
PID 4204 wrote to memory of 2964	4204	msedge.exe	106
PID 4204 wrote to memory of 2432	4204	msedge.exe	113
PID 4204 wrote to memory of 2432	4204	msedge.exe	113
PID 4204 wrote to memory of 3300	4204	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\__MACOSX\api_olivetree\application\._index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffc1aaac188,0x7ffc1aaac194,0x7ffc1aaac1a0
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,6536307605153218302,7840843152734752478,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7783479599736183963,15618877698249972795,262144 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,14920312545518244243,10342359649305021403,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17112297402449503864,1889421784372198515,2097152 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9519519657554530485,3459304141380872764,2097152 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,11660927414126481585,15349599155437908777,2097152 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,13791813208278996320,9019262861697444065,2097152 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,623389885162399880,15319269500453133260,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,344491335611487854,11368574318831890027,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4678147750994142910,15011633517311499696,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4678147750994142910,15011633517311499696,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=612,i,12445388535425479597,14325149167829438597,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=636,i,6972761104497611324,15576361292475456082,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,12735196381528305706,17389698168746117480,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,14115656255550813356,4951231018641896172,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,4019432421157159704,15559353403678074256,524288 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5356,i,9744667671101196647,15051321052154557472,262144 --field-trial-handle=2044,i,14190873746729813604,4581520290824620355,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 33403b85d35b9167dfb62ad8492855a603fd3bf3b569bf6f33611feb29df8e9f
MD5 2a9eb65a398065d2cc039b6f7f39d380
SHA1 03575f642f411193b03ff35e513474e168827c53
SHA512 e18be87c55bc0539db77bf3ae11ff817383c55ec861b37d158af0e7a10ed53f97d4cc09d582983446e7ff5ce3bce42ec71b78f8afa0628fc0c1435632f3c4681
TLSH
T1356182191A4E14B5F7611B31E4C10600F9B043B90EB72ED336F8D97EFA2EF23802559A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ace5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ace5.TMP
Size 3KB
SHA256 e4b4070d1426888f97dced52bb99ef3cb92c453ca558badfc3c68533bf60f82b
MD5 b142affff06471dfb0f8ba2a4bbaedcb
SHA1 4f9985462923620d01243d6c37103599d66901ee
SHA512 8e97759f3782beb6be892bb1abe23ca856b8cba1d38e94c7917338550762384ac684c141f93af9990c62cc805b1f530c7f628866df30f0bf00602564f001fb65
TLSH
T142618119194E14B5F7611B31E8D14600F9B042B90EB72ED336F8D97EFA2EF23802555A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 5b1a12774a662662571e3414358aa1d5e3fed4d97841b9365823d1fc0efd6901
MD5 bc066556c326b25de60f186effa2689f
SHA1 0fea193bbd06a6037b8800c503fcc5dc62feb806
SHA512 42072ddee880b7470415ea9a2983fa3d3cdc79fbf688ee35eef534c2c10c6c6047439c76495048e256900a4245391e65fcc5dcf36bfe07ac30156867ad9d946e
TLSH
T18F019CB7C3E4856E8A0152F06A18AE1BDE2D0502931C7C1AC9D4AF2B93F3475E10189F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c46987c30a3e1d6b7e2c1746259ee5507449c9718ac69d5ce987e721e633e7cf
MD5 7efb991527cbed521eb8aee316a33afa
SHA1 689e67f9ee5dea36d8d6c3c5f17f471a2e254fc3
SHA512 15136993996b4519c0bd319fbfab28bc7ee0f08dae08309cbcd0f09365286def6e2db962fbfa40d7c2c503a2b45c37a8c6958651e9e50c6c88c69b7c9756b4cb
SSDEEP 192:sxZzRaLyM/jK1Ml8MkN/fMsgdIIdpdGHW6+WNGYLzXY+tIgrJ:sxZzc/MN/fMsgd50HbGfK9
TLSH
T15B42E816AB349977CCDBD20DBA55BF53D6F90472E2900D44A9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1efdfd8ac5c1835663af7ea14e70756263ef492153addec55037f970a2690e12
MD5 6a1df5f4d7181fd45b27b4d17d8c837b
SHA1 ff9e8e4230fe6b399f35e2867d2779efef583b05
SHA512 12ad8883aea2906ec7b8c6e1d7b8bd4fa6d38edcacef9eb45a0b717bf85c5e956a47b889b1b63ebe0003f83cad8293bbfcdcd70dc9a8e1302fa494d14b376bd4
SSDEEP 192:sxZzRaLyM/jK1Ml8UQGkN/fMs+NIIdpHGHW6+WNGYLjKF+tIg5WJ:sxZzc/qtN/fMs+N5mHbGvKQ
TLSH
T19452E716AB349977CCDBD20DBA51BF53D6F90472D2900E44A9FCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 46e4fdc562cb7391cc8ddda5195517f35e646f7c980f01e3445dc5d5f6056598
MD5 03c8c5345478ace29e979e4ee6fc5d50
SHA1 60f5ff26b7437d1c88987229eb9fab2913a4c490
SHA512 5bf223685db3ec44baedaa5a95f459a63f8ae8936182579265e3532890237b507f8b9ee6fa7d88de7a4768053a7532dbc9aa251bed21c2121f6eeaf46a143d1c
SSDEEP 768:Nps6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNqro9Q:Nps6pD1WvxzWju1jahILIsNB9Q
TLSH
T1F6D2FA3B680CCB7E4F840E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2c44a2b6a8a3d416f0f3df1a71bfc14317a6ea017d90e4e8ce87051bed5b40a5
MD5 84de7b5e501b1969bffb4e5b696a7d54
SHA1 9cd13244a9c5a06aa7acf39627fe75837b7ac359
SHA512 cebbe68cba7adcff897bbe9906fc124b147c0a36caf5d9ed7fa4d8672cc0e26f175680c47afb21a82009c0931bcc9c74953e23cd703b1ca37f1432af1d1139bd
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFzIVKwEfyI/Kva4bytLIxK8IMMjIBKJ:KUAAKteP+zWKwEfysKva+OLeK8IvjKKJ
TLSH
T1BBC1440231BB02123C7E2908A39997665F82B6A37454F52B77AD00765EA7F340DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594915.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594915.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 78f420384859c48b85dee596fb9f97c8624063f1839dbf165d431461711ef403
MD5 65648afc9f92ea565c1d3e89fa307a48
SHA1 bfd989dd26cb36030f2d3652dd2b0a0a92271e79
SHA512 1b8332c02867bd87c3e23c45c92792ad9a0a15e4610dbe549f38e83515c34a105b90c8f4901ad238325c33d03ae3994978f11dc038c9c8cc0f89b1125fab330b
SSDEEP 384:SZcIhsN3Utej0q/wza9sO7SBckScjmwZzS:ghUj0T2iO26k1jdG
TLSH
T180927D37AD789C769AB6D045F98636178E788073DAC95F80D5EDAF0C00DB9AC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9559fa9012f31273f8ccae954b17f88139c3b52dc71db27fc4f22a54af6d44fa
MD5 37476b0881fc08672b890359fbf05a26
SHA1 b72b526dc3b3be1568be5b30373611dd6a15c3f8
SHA512 ddff80a8b291f9e9059fa162bb5441b06b96c66932cb9a8349c2f3a6e55b5f6e93f103bd5a3ff69a7499c165f73ed1fd0175eaab79e402fe871ac9a9023763e9
SSDEEP 384:kZcIhsN3UEej0q/wza9sO7SBckScjmwZzS:ChHj0T2iO26k1jdG
TLSH
T1A6928D37AD789C769AB6D045FA8636178E748073D6C95F80D5ECAF0C00DB9AC1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6570d1e80d35946e2bebecac2dc74a7b894aa507797b77fe4e4e353c347e3741
MD5 c5d48700f9b43256953cc063c1c3e565
SHA1 7a7a8ebc3ce4576ab5717de5d00c334103e0b02c
SHA512 9633a12d4cfcdedb25e96c3ecdcd9392525110d1200ebd7f06704f92cb7cebd7bc9b9b7435335d13f6d08a58d5c1a0122a6edbfffad3464ba72532ae5612c872
SSDEEP 384:KiFiZcIlzsNs8TUNTUlIlEej0q/wza9sO7SBpkScjmwZzS:BFQd1wghj0T2iO2Hk1jdG
TLSH
T1FFA27E379D68C97BAEF6D645FA8632178FB440B3CAD59A80E6DC9E0C00DB5AC0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa7bf574f9f2d4e3665a8d9c99c88e731ba73811926741a26a232caf6d7d923f
MD5 c43e49f515fc3e3c2ffefd123866b5bd
SHA1 27a548a80af2b68a0e1c4de8e0492b259107e169
SHA512 08e9a7e929a3fdbe04c7aad0ff5938e446239e77d89530cc623241464108c3874ba21fb5f9f121c7e5faeeeb022fdbfffebf82505dcbc6f84982ee52a994e1af
SSDEEP 192:qONp6O7+3hQmiUyRjGttb0RO2osgGrfU6:qONp61OGt9sO7C7U6
TLSH
T1A502093968786CB78FF2AD49F68727275FA5113BE9962F40D5E81F0C00DBA5C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d90123bbd4fb69c3708eb3713fcc6017eb02caead683b54f3324b88bbaa0c748
MD5 dcccc3876a9f304ab8543a2ffe75f570
SHA1 2388ab5abd5e6eec55a927773ff06c73d8b795b9
SHA512 88cd92f27c167b68e1f7f73c36967bdd326c224164d25dd9210183a0b70ef03fc381ffc0ae1b9b8b91dd28d256a316220d6f85b008183a4e5c9e5b3f41f954f2
SSDEEP 192:uONd6O7+35QmiUygjhttb0RO2oSBtcNsqaJU6:uONd69tht9sO7SBKkU6
TLSH
T1E912193AA86C9C775EF2A185F98732174E65413BDA867F80D5DC2E0C00DFAAC234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4821565-0992-42b8-b55d-e72a3e9d2457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d4821565-0992-42b8-b55d-e72a3e9d2457.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e3782e26776bbd4f844425b65781a2df1d9c8c57f59d0e9261a484d6eaa8258d
MD5 7106785e25a9aa4e0130238501a57d38
SHA1 311b2d61ab92b56183259c3d7712ffbd11d1e1ac
SHA512 fc693e86679b40af8455ed606071e561f5779a8325d36ee688a11aba58db82df28d30c45dfd984bf23ad44604ed9729b1dc97f6135568850fe654778fb5c2d26
TLSH
T15D41FC58A6F91148B3B76F569BF6B86D587BBD372F06849D00110E4F0A67A40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download