8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/__MACOSX/api_olivetree/application/helpers/._index.html
Size 222B
Sample260729-xmfddsdc53
SHA256 8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c
MD5 b1ff28ad21b92cf42f82786c95985de6
SHA1 2e2d4d82a1c8831959af1d85a10c0a811e5701a1
SHA512 02ae858beaef74edfc017837ace8e711c10e9e6b5b66db3cf8bd1b08168c3ec42444658a5c78cf2ab6b08cdaf42fb8bc49f36dabab83f566c28adaf25191a129
TLSH
T1A9D08CF021141D46DA55C2F22986A8D02B36B4B4C2671377744EA0403B40A51B7F0307
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298252172370680"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{A513BAE7-1B84-477F-B326-D3A1A9BCB37D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
708	msedge.exe
708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4460	5036	msedge.exe	83
PID 5036 wrote to memory of 1536	5036	msedge.exe	84
PID 5036 wrote to memory of 4488	5036	msedge.exe	85
PID 5036 wrote to memory of 4488	5036	msedge.exe	85
PID 5036 wrote to memory of 3248	5036	msedge.exe	86
PID 5036 wrote to memory of 3248	5036	msedge.exe	86
PID 5036 wrote to memory of 3248	5036	msedge.exe	86
PID 5036 wrote to memory of 3108	5036	msedge.exe	88
PID 5036 wrote to memory of 3108	5036	msedge.exe	88
PID 5036 wrote to memory of 3108	5036	msedge.exe	88
PID 5036 wrote to memory of 3212	5036	msedge.exe	89
PID 5036 wrote to memory of 3212	5036	msedge.exe	89
PID 5036 wrote to memory of 3212	5036	msedge.exe	89
PID 5036 wrote to memory of 4856	5036	msedge.exe	90
PID 5036 wrote to memory of 4856	5036	msedge.exe	90
PID 5036 wrote to memory of 4856	5036	msedge.exe	90
PID 5036 wrote to memory of 3896	5036	msedge.exe	91
PID 5036 wrote to memory of 3896	5036	msedge.exe	91
PID 5036 wrote to memory of 3896	5036	msedge.exe	91
PID 5036 wrote to memory of 4732	5036	msedge.exe	95
PID 5036 wrote to memory of 2264	5036	msedge.exe	96
PID 5036 wrote to memory of 4732	5036	msedge.exe	95
PID 5036 wrote to memory of 2264	5036	msedge.exe	96
PID 5036 wrote to memory of 2896	5036	msedge.exe	98
PID 5036 wrote to memory of 4264	5036	msedge.exe	103
PID 5036 wrote to memory of 4384	5036	msedge.exe	104
PID 5036 wrote to memory of 3376	5036	msedge.exe	105
PID 5036 wrote to memory of 740	5036	msedge.exe	106
PID 5036 wrote to memory of 740	5036	msedge.exe	106
PID 5036 wrote to memory of 708	5036	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\__MACOSX\api_olivetree\application\helpers\._index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fff9311c188,0x7fff9311c194,0x7fff9311c1a0
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5175748181716230912,14428152698063552165,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,12124919591510160491,17327617661691928152,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,10375478093827763649,7476038198724589177,262144 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,15324142769902721829,2354525814953584732,2097152 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,3490910770652257387,13789495502919566608,2097152 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,432248873402839910,5364873403794226710,2097152 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,14920825609835650387,10227599991065584621,2097152 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,14605050201419669808,13484698071088483946,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,16256417584385474759,13665587035940277558,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1975990389657068226,17235301429593700036,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1975990389657068226,17235301429593700036,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,3476969375366228856,1173455456812059157,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,3277822578193966071,13334879278827423845,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,5395404804025022303,17715574326055945326,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,18027588309651106732,6012608408096797911,524288 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,11843286865048348358,14333002321677353995,262144 --field-trial-handle=2428,i,17098814392413323546,2708870679058664621,262144 --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cd428c5e61510cd6ddbd616884e974eb2d27fa6076193b1a5bb6c83738006a9d
MD5 45008f363cfad11c7892ce175fdaa5af
SHA1 be046d21b0ddac528264fab95cd574471aeb80a0
SHA512 c886b18abc2e0e8d51ac4bdedf3152d4834775b39142b84dd68315b88ba0dadc06eb3645ac7a9c4276df4e505a5df5105f7df6888033acedaef961d8dad81279
TLSH
T1406170394B134883F32B02F0F1C2162639B381A40AA79E4A3D64C9FD691DB26CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589e2f.TMP
Size 3KB
SHA256 0b12e1a78bf70cd7e41017a8ca56178208228d9ccfa36cdc593e8b19ffa737ac
MD5 b5aef7e51740d7be0c0eca3442f305d4
SHA1 755cc1f224be0655598f1ff80823ae4f574ce725
SHA512 47f562f6db8c09175a01e500688676f4709d3455432798a5376d5d1a357728aef009c2a7daaf76dcf5caa07b48d5701057f180865141171cb4d2840d89fc91b9
TLSH
T1716183394B134883F32B02F0F4C2162A7573819409A79D463D54C9FD691EB27CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 4fe8571fbdf2c2dcec1d999d29449fbdec10944b3258728286ecb74a50fda407
MD5 383cd187ec75a3289dfe6618948078b3
SHA1 80049ec508c5185c6cdedc1e25bc4ef48cd4f454
SHA512 01363519ccc9d5a21dd4907ad3d9b09db80dfa456c01e6f8e064bde41483d639408f7b3bb564c2085e7fdef544daee14393ff1ab0bcdd7b4060f760fb12c8327
TLSH
T10A117DF7C7D585AE891156F06A24AE2BCE1D0906832C7C1985D4FF2B93E3475D10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3e1999236f64b32e770cb46410397b5e5eb29b6344d42216c0c42028d9e691c1
MD5 40344225ae7384a922309ddb123e5691
SHA1 d0965190366a8a7d2d8ee7114b2270777baa13af
SHA512 4e357d06f3d2277b6cac22fd643cd3e6bde3db2d532ef8c6fb1cc5a67c00cf9803a4ea04ad8452101b4a05a34084ced416b53fbbd0954974bc9fc86fe91ef3f6
SSDEEP 192:sxZlRiyM/jK1Ml8Mkt/fsswP7HlIdpdeHW6+WNGYHjJF5IgrJ:sxZlAMt/fsswP7HWIHbGg9
TLSH
T13C42D616AB349977CCDFD209BA517B53D6F94472E2900E44A9FCCA1C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3a2f698618316a29a6df8d2efe1034bb5d7791a3f7a8e089ac26d76b4a46be2a
MD5 1c2c034892efacb7293f3ca9a21f90df
SHA1 46d6c9437819297e2da11760009eeb89f15fb769
SHA512 f62b32ee8be22669a7e7b0653c60f8a10e30e867787b1c94d70228057cec3a334125c0a23f0ce0a61425294c523acd28bae1f00c9443790bc2987cc5eeeebf88
SSDEEP 192:sxZlRiyM/jK1Ml8UQFkt/fss5P7olIdpHeHW6+WNGYHcEP5Ig5TJ:sxZlAqOt/fss5P7oW+HbGW3
TLSH
T1DB52E916AA349977CCDFD209BA517F53D6F94472E2900E44A9FCCA1C01EAADD231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f24c53da77173975cb8d63a4694b6fc0fea5af41255e362935f1fb0983b21bb5
MD5 afb74b45a39c9a58aac44236a8e48fe5
SHA1 b321b627ff823ce40e06eb5a99452bfccc17e2e5
SHA512 0a6b6e17b6f87bd774197b8e9be99ff845c65ab1d9a1ac019f3ded5fe9b0e891ad0f8d700a4621b4fed9a678bf86193747b07aa00cc900560067bce5d49fb8c4
SSDEEP 768:RcUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4ReroVA0tC:RcUZYTMWvg0Pou1ja7eLZmR1xU
TLSH
T1D3D20A2B284CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA894C03CB2EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ffdbfaf49465043705ca8fc260e1f0a24289e29d876f98d24cbd08ef00cce681
MD5 9a5ea57b66cdc8a6daf8dc48ed5facd1
SHA1 b26770fbecbb4b118df7e00c221143a5cfe9b916
SHA512 16218e0a2d844ab034ee65ebe18d6ea2c590163d76806b4679c01fbe5f4054d5a282505393700e410e72ad494db6aa93eacc2818ec4829ca514b155e63fd740b
SSDEEP 96:KA1eK2AUkQKJW6+DuKY033yKUAyGbOKUos:E2bppRd5
TLSH
T175D1084A70BA12413C7D2A48935497178FC271633228B42B7FAD41B29E67E21DEFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2a8a302fdc41776afc768a14df5be80cfe0a48adb1a4e2dd712471f00c10b9e8
MD5 e95fa7f41cd290156216f4be11d608e2
SHA1 c75cc62117a045b7226d2c3d4b1459634a5a94f6
SHA512 358880ad4a0ba1b6a460d457fe1482ab95a85871a50bbe48b9dbbebb923e8c22f80c9d122f11cdf30d53afc05ab682637c5d24e33dffc2bba989df846136a9bf
SSDEEP 384:XZcIAzsNRapnBtwKwzX5od+685X8tJr2GEjScjmwP:fcl4O0Gh2Go1j7
TLSH
T163926D32AD64AC779AE6E145F44B32138FF8A063D7C45F80D6ECAB1C01DA5AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92e6fcb9cc0b70f83f162f3e14bd8760814f71c772842e710eac658224c1838a
MD5 f3050b9d95a2d6b298db156bebec7c41
SHA1 34400f1c3b858c4ff66793665d9390dde01055f7
SHA512 6fb30a05d64b013701046caa49d04103fa477eba3911969fb54e4d73253d3d5cc88bf0c832e3a671175f0a97f116803bb1e0888859a611faa127339de779662c
SSDEEP 192:yONo61VWQmiUytggGX5Obd+jqjzorvmk/aG43FOgU6:yONo6WzgGX5od+68UGeOgU6
TLSH
T17002E935A8687C6B8EE3BE49B44737135FA92177EA542F84D6EC1B1C00D769C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3fea8358fede2dd8d659048132ccaf7e47f69d2608cda4d927779f44d51ea0b2
MD5 7111cdfb1a1d9adc716027331fc0a9dd
SHA1 e37a9fae4719f368a9e8213f20ca38853915eefd
SHA512 5041431c307c1a536a1ee01a86b0cc043ce1fdfea9895b55fa8701c67c98d6614a0deeb48adc2201d5262b161d4fa4f4efdf1e3bbcac821811eb414d82e3b4b0
SSDEEP 192:zONU61lWQmiUyBgwGX5Obd+jqjzorvmsX8ySJrOjJGEcqRU6:zONU62xwGX5od+685X8tJrKGEjU6
TLSH
T1B312F936A868EC6B5EE2B585B48B31135FA85127DB857FC0D3EC2B1C01DF69C131AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 936fb960a3347a792647c52de0d844c6e0342960a789fb0d19ed33ec27e77cc3
MD5 404d65e10e30d02e78dd1cf925651352
SHA1 7080ecccace009767c4a36da772c01ed4c5e2152
SHA512 0bcbdd8d05550d4f420dfcd5b04a635a8c2c9c325266afffa5a54a41f2cf4d7facdb2bf728425d69bb3072f140b62b2fa8c19611022b47508a5da2524099bfd3
SSDEEP 384:IZcIhsNRfpnBtwKwzX5od+685X8tJrcGEjScjmwP:2hw4O0GhcGo1j7
TLSH
T123926D32AD64AC679AE6E145F48B31238FF89063D7C45F84D6ECAB1C01DA5AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a1346662a799059428f789dfb8dfbf769a03998d39f44d507ba8feacc2a633b7
MD5 8ccb04e6ae6542662191b0365258f2e1
SHA1 d86474e0ce9571137eabb09ec21f66778dae763d
SHA512 2fc60175eabc2c557f41759770aaf99c786f2b7413cac79a6c88050546ee1eec74b7a1f3ab874cd741ac39251a2ad765c7b418f90ca4caa04bb74c6e551613f1
SSDEEP 384:AZcIhsNRapnBtwKwzX5od+685X8tJrcGEjScjmwP:+hl4O0GhcGo1j7
TLSH
T1D6926D32AD64AC679AE6F145F48B31238FF89063D7C45F84C6ECAB1C01DA5AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11e1eaee-6166-423b-be4d-a9730d9427c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\11e1eaee-6166-423b-be4d-a9730d9427c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 14a1a53cd297a0ef1cde7b7284c5123f4f269d7fc51a9be2804da987ad2c211e
MD5 0b1934f2559be97d6a565029a07985d8
SHA1 2caf722c2693de31920b20584040b4d121ae1274
SHA512 bd500005e45e9dd3f7f1c1413e43ba35319595490d215b32e9b5b917ec8b0a34ee52d1cf7c007d329e83e868d50fbc67e752661d0c5895d1bc6392ee9b5792b1
TLSH
T127414A58ABF91008B3B76F5ADBF6A47D447AB8372E0AD4AD10110D4F0A23B41C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download