8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/__MACOSX/api_olivetree/application/language/english/._index.html
Size 222B
Sample260729-xmfddsdc53
SHA256 8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c
MD5 b1ff28ad21b92cf42f82786c95985de6
SHA1 2e2d4d82a1c8831959af1d85a10c0a811e5701a1
SHA512 02ae858beaef74edfc017837ace8e711c10e9e6b5b66db3cf8bd1b08168c3ec42444658a5c78cf2ab6b08cdaf42fb8bc49f36dabab83f566c28adaf25191a129
TLSH
T1A9D08CF021141D46DA55C2F22986A8D02B36B4B4C2671377744EA0403B40A51B7F0307
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298252258641893"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B529DDBF-35A5-408F-BCF4-FD41A90386F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4308	820	msedge.exe	84
PID 820 wrote to memory of 4080	820	msedge.exe	85
PID 820 wrote to memory of 3520	820	msedge.exe	86
PID 820 wrote to memory of 1104	820	msedge.exe	87
PID 820 wrote to memory of 3520	820	msedge.exe	86
PID 820 wrote to memory of 1104	820	msedge.exe	87
PID 820 wrote to memory of 1104	820	msedge.exe	87
PID 820 wrote to memory of 564	820	msedge.exe	89
PID 820 wrote to memory of 3364	820	msedge.exe	88
PID 820 wrote to memory of 564	820	msedge.exe	89
PID 820 wrote to memory of 564	820	msedge.exe	89
PID 820 wrote to memory of 3364	820	msedge.exe	88
PID 820 wrote to memory of 3364	820	msedge.exe	88
PID 820 wrote to memory of 4240	820	msedge.exe	91
PID 820 wrote to memory of 4240	820	msedge.exe	91
PID 820 wrote to memory of 4240	820	msedge.exe	91
PID 820 wrote to memory of 756	820	msedge.exe	92
PID 820 wrote to memory of 756	820	msedge.exe	92
PID 820 wrote to memory of 756	820	msedge.exe	92
PID 820 wrote to memory of 852	820	msedge.exe	97
PID 820 wrote to memory of 852	820	msedge.exe	97
PID 820 wrote to memory of 5068	820	msedge.exe	96
PID 820 wrote to memory of 5068	820	msedge.exe	96
PID 820 wrote to memory of 3724	820	msedge.exe	99
PID 820 wrote to memory of 4136	820	msedge.exe	106
PID 820 wrote to memory of 2380	820	msedge.exe	107
PID 820 wrote to memory of 4660	820	msedge.exe	108
PID 820 wrote to memory of 444	820	msedge.exe	110
PID 820 wrote to memory of 444	820	msedge.exe	110
PID 820 wrote to memory of 3540	820	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\__MACOSX\api_olivetree\application\language\english\._index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffc04f7c188,0x7ffc04f7c194,0x7ffc04f7c1a0
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,16558172962761926564,6182225644751041083,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,9707080716776387835,7058631207968434571,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,10106729581256735469,9160942087078885133,262144 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,12580591666421756686,15165797674172529639,2097152 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13396893238952246704,17381357886875029569,2097152 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,16295862863437699149,9543905684527091608,2097152 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,7250599426618736556,15716039662974631097,2097152 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17162851644786937572,14380222148443517436,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,14331316001254826826,15916512428404230965,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,4437567900197099287,7027674393981012860,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,4437567900197099287,7027674393981012860,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,7397007404847293792,4634339514128562337,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,10601309848176613067,9796404235990479580,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,12233989191872584733,5670910617891003341,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,14938650809197597661,4262692592383282779,524288 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,18233943530422092969,13486105854504519537,262144 --field-trial-handle=2308,i,14199646132830322781,17754453679220355200,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0db2422ab09997d4fa6b4a2415bb7575f03756cbe02949cfccb39350916249aa
MD5 8ebe75c7df73f1bdcf57aa0e14d4fdb7
SHA1 288ff6555065330ebdf1b72aecb48502c8efc2d2
SHA512 9a61bf0643b891c37830e473a8dd18993c7805e40f5846678823bf6ba64349df1de4446aed05028d681b3352c1f657abd7f99605953d19c2569c647b96e9b0a9
TLSH
T119517F3C1A110862EBC10533F0FB9A54717985DDFA13AE73C6B36D7A6B0A321C00D389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d29d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d29d.TMP
Size 2KB
SHA256 8e4db4cc6f641c931cec3bbb7a3b160c02cc54decd2b598ddb8ec69f4a16b76b
MD5 09acd08c3cc322155b87e0bf0dda50d9
SHA1 1df6b4f34efc64a4fc8849a33d5594dd03abbc39
SHA512 173d0564aa76f7b731bd9a206d72f35e55eb72218f7e2394c83dda53a65b2e51aa4a58debf861d51c569ced162dedf0d38ac5ce1a2c1bbb8d3f39b6c2c9ffb1a
TLSH
T18D51603C1A510862EB900433F0FB8A54717985DDFA13AE73C5735D7A5B0A325C00D389
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6264ce7f2cb3e67645217957f7ba713325c40f59355fac2f43383cf5dc399d8e
MD5 10dc6ee6c422eeb6d5bb410b55c1ff3a
SHA1 e8fffa9604570a66249922e9769ce9b8ca7daf83
SHA512 833145c22ddb2d221cfd0660a83d3f8b1809cbfe8076c9026f3735fbcfe6dfb662a68c3dec1000abb15373b636dd44f1e8a5ad1ad2ce0b7039c9914a8d913a00
TLSH
T17F117DB7C3D5856E8D1116F06A24AE2BCE2D0606832C7C1985D4FF2B93E3475E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1a39feb9124bf0bb7ce40ed7d80bf95c11e6a2bd40239976a189b0453bc2df4e
MD5 26a7fc3305f9f9e9b9c31971c43bbb4d
SHA1 ed67c1ac7a3f447eadba11a616a79ad9b1278631
SHA512 d00e283525922eabd149d91bbdec4fd8a9b783f0191092a15dc501e9af38850362cadeefa927971124c86ddb22a04c1bc1a106380d652f6ac2ab4b92697c3caf
SSDEEP 192:sxZURBk3/fXsOg39rFIdpdbHW6+WNGY9IKVq+wgIgrJ:sxZUs3/fXsT39SBHbGHk9
TLSH
T15222A7166F2895778CCAD219BB65BF03E6F9503191941E58EAFC8A1C05E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 45aa7f64be0a6e30702e45c476343a9831070e0a05e35639ccc693abf33b43c9
MD5 940742e34cf1bf417c3eaf1a74bb1537
SHA1 9a1dcc9139f9d1526ce76ed839e6dce5b9bddfb8
SHA512 2da47b9f1d6f601a037478857ebd0192f6cbedf5d0ed6799613c866a97f4056086930c443d22e08377edaa73f85dde34a148fa40db30ab2c7854ca7eb5658cdf
SSDEEP 192:sxZURBk3/fXsgg39rFIdpdbHW6+WNGY9IKVq+wgIg5NJ:sxZUs3/fXsF39SBHbGHkh
TLSH
T13122B716AF3895778CCAD219BB65BF03E6F9503191941E58E6FC8A1C05EBADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 41d890ea5cafb322b42a512392cea43e1f2ff239bf18f0748ae83731c1f1e8fa
MD5 f3bd60048de8af8a2283a09d8ce213a0
SHA1 601e1fffbcccbc3247b7fe66a7871c651d5cae0e
SHA512 f30b880fd0580942f9202f9c717824eb7550d3abf85efbb21466f7366ee123693074021aa00dd08f4d3f835dc2528be1f16ee5a3dc93fea339b75713e0392be9
SSDEEP 192:sxZURBk3/fXsgg3+rFIdpdbHW6+WNGY9Iyjq+wgIg5nJ:sxZUs3/fXsF3+SBHbG/kH
TLSH
T16722B916AE2895778CCBE219BB65BF03E6F9503191941E58E6FC8A1C05E7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 40301fc66f344f16f0967954e633eb7a9148e6d071f9f78bcd701e42bdc4994e
MD5 ca004029afdeeab024dfb55fda265530
SHA1 f9f9b79274fb61e376d1217bd43d84665f7a9cc5
SHA512 2eb1ed19f414081b0a1b3903e31011ccb1e4489c570db8fa96a1c568a93a207d2d06f20422b49d3add02aa1952ad48059f14038d57afb35ebfb764e36d9e6057
SSDEEP 768:dTyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7Gro6bqI:dTyvIZwWvu+Q+u1jamFLeR796B
TLSH
T175C2E92B240CCB7E5F801E9DDD5A6F9B3EA802CB67588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b4bd8a02abd1eaaf9064b3bb626c2743f21e6c3d58859c52c848dd45ebff534f
MD5 be0d23655ddac1c101d2c0091814e361
SHA1 4d7b3bb36a4daffce4f85a90350a4c75f5d1f1e8
SHA512 4b1e1a06986a58e810919b9e8fee5705b7db678cc690b327dc058393af8747cccffa7e61e306fc8abc9f46aedddcf4f829db17df495c4a17e0562f33e90f7df1
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDiVxiKCYKWV6K+8Y:mTXJxv
TLSH
T11E917306717A06D1387E690CF37595278E81306E7498E83BBBE841629F27E531CFC6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596ebe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596ebe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 9ac37ea75f9a65c8fb8fc214214b088bee2c4591a31e1c6398c06bef787d184d
MD5 71b1c1eeab7255608d54f71de7e45e9d
SHA1 fb9121259f5f61406192a61f06c9a06f37f1ae8a
SHA512 b5ee6c2d72276865a347d1415cbf0632354726d5a7b95fc4926da99c76eb72e0d24b00fe345724a09038e4fa6bdb49d980c400e50495ef9f9b98c1558bd4a452
SSDEEP 192:u+LsNoUfVQTG6+YLes4QmiU17vQdj4e+CGX+FdeNNkGQNgSJiBqRScjmqYoJXmgw:VsNoUNuZziBmMe+C9d6NXe+MScjmwIR
TLSH
T1B4725D3BED385C669BE69155F44736139FA851A3DAC82F90E6DC6F0C01DF2EC130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fbc80dcc52682f5d7888a69664ac075907442b00fe0678a8ff155a5bfdf0d08b
MD5 accf15e032d6cc7719883be264cf7796
SHA1 6a00df1d2aa6ccaafbbc0e0c95f4220a77acb030
SHA512 1df915ea8c13b8b1d859180be8d220c56260419c7bbae82673fab6b9eefe8f721eeefd67826de97a3fa94ddbcaa0373834aada775b095bea8ca2e1a8444ad82c
SSDEEP 384:ziFYzsN+8TUNTUlIlQuZziBmMe+C9d6NXeJMScjmwIR:eFkRwg7ZdnFPM1jER
TLSH
T156824B379D68896BAFA69A41F54B32139FB851A3CAC46F90E7DC5E0C01CB1EC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1f3a4e981d63487d2b818412df5db68f2c1de681fb36909b55841702d2a391f8
MD5 7f45c5a4a7809120e0124e7fae8a42e6
SHA1 bc9f8871e931a80ae6461ead7b19d13fccf2f4db
SHA512 8cd68d412fd97f77f5350ff99f55ab92141c6b26c7a2aa6319f9a6e69086ba3eaaf2c8e00eaff38e976476fb40290cf73e5d7aee451daa1920f23e6578c5e92a
SSDEEP 192:JONWS6v+YLNQmiUyJwZh+CGX+FdeNNmus4pU6:JONT6vz/rZh+C9d6NIsU6
TLSH
T19602E935AD382C6B9BF2AE05F48737135FE8117BEA952B91D9D82F1C01D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 5df847e4ea8c612665aee7dd9a8a77d4aafeca84cab8a5f82bbc83a40f3f81aa
MD5 076fc3979653d30a7dc0ff874883df7a
SHA1 95af54d3b60eea484d4ed9830a86ed64093a9f7d
SHA512 8f188b1953299829fdd4150c30f5dbee2580a217383a308af53343d0d07aa43b7ccf046c43023cb7f5a17846aa41302fab4b9127545e17bf70cd4b6cab73c9fd
SSDEEP 192:u7LsNoUIVQTG6+YLes4QmiU17vQdj4e+CGX+FdeNNkGQNgSJiBqRScjmqYoJXmgw:usNoUQuZziBmMe+C9d6NXe+MScjmwIR
TLSH
T1C1725C3BED385C669BE69141F44736139FA851A3DAC82F90E6DC6F0C01CF6EC130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2a3fa816cb7c3be86564a3f8a5e29f91006e29ec3dc3ae76e4c5ee6debe0b19e
MD5 e2b02bec41b5a731b48b26b2de7be9a7
SHA1 607bb96b9b07cff37619871387cd6a3d577ccdd8
SHA512 d5f619514ca410eae0b6406b280d19d0793e0e37681847f0bd98bfbddcf66282170c0fbb806739f46a47f2b4e0b9733229ccf7681f4c70a9b111f50002fd42a1
SSDEEP 384:ziFYzsNp8TUNTUlIlQuZziBmMe+C9d6NXepMScjmwIR:eFk0wg7ZdnF7M1jER
TLSH
T152825B379D68896BAFA69A41F54B32139FB851A3CA846F90E7DC5E0C01CB1EC130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24a211070f77dc46460efe34cb66743eeff0e2df61f52f2405fa2d5f99de82fd
MD5 41b5a53c769c0eb7fe709802576826e8
SHA1 5f98237d4aafd4aaf532ece68bb06662953c83fb
SHA512 bfa54eb9781ba27f6e493c2866558add56df7dbd2d3e71201c719703c12f680f8dfe4aecda84b2ead17c3f7cc4596ddba4b13e7abfcd04f3d3d1660a6e022296
SSDEEP 192:MONi6v+YLCQmiUy95wch+CGX+FdeNNkGQNHCHBqRU6:MONi6vz6Lch+C9d6NXecMU6
TLSH
T102121C36AD785C6B5FD2A941F48736135EA85137EE893F90E5DC2F1C02DF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daa410cb-35a1-45b2-bb06-dfb82f26f027.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\daa410cb-35a1-45b2-bb06-dfb82f26f027.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 33f1671f8de0b46b11ba4695abffde482f376330e9aa892ecea5d24bc3ecbb7c
MD5 621d9b42233318a23156790347e9c5de
SHA1 6588068358802d40811c2be5f1c14d61e2093ae4
SHA512 58de17084e64b985871d2a53c25092517f79f746542a58c0ca38a9dff22be5ada06e696fc6682b8c8fed4d287765b8435829d7b09af0ddc73300943497355601
TLSH
T1F741E459B6E91148B3B76F56ABF6A86D487FB9372F57D49D00000E8F0A22A40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download