8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/__MACOSX/api_olivetree/application/language/english/._index.html
Size 222B
Sample260729-xmfddsdc53
SHA256 8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c
MD5 b1ff28ad21b92cf42f82786c95985de6
SHA1 2e2d4d82a1c8831959af1d85a10c0a811e5701a1
SHA512 02ae858beaef74edfc017837ace8e711c10e9e6b5b66db3cf8bd1b08168c3ec42444658a5c78cf2ab6b08cdaf42fb8bc49f36dabab83f566c28adaf25191a129
TLSH
T1A9D08CF021141D46DA55C2F22986A8D02B36B4B4C2671377744EA0403B40A51B7F0307
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3436	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298252316870254"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{F4EF1129-CE80-49DF-81F2-82774A9D7F12}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4740	4080	msedge.exe	89
PID 4080 wrote to memory of 5204	4080	msedge.exe	91
PID 4080 wrote to memory of 3436	4080	msedge.exe	92
PID 4080 wrote to memory of 5204	4080	msedge.exe	91
PID 4080 wrote to memory of 5204	4080	msedge.exe	91
PID 4080 wrote to memory of 2764	4080	msedge.exe	93
PID 4080 wrote to memory of 2764	4080	msedge.exe	93
PID 4080 wrote to memory of 2708	4080	msedge.exe	94
PID 4080 wrote to memory of 2708	4080	msedge.exe	94
PID 4080 wrote to memory of 2708	4080	msedge.exe	94
PID 4080 wrote to memory of 4216	4080	msedge.exe	95
PID 4080 wrote to memory of 4216	4080	msedge.exe	95
PID 4080 wrote to memory of 4216	4080	msedge.exe	95
PID 4080 wrote to memory of 4636	4080	msedge.exe	96
PID 4080 wrote to memory of 1172	4080	msedge.exe	97
PID 4080 wrote to memory of 4636	4080	msedge.exe	96
PID 4080 wrote to memory of 4636	4080	msedge.exe	96
PID 4080 wrote to memory of 1172	4080	msedge.exe	97
PID 4080 wrote to memory of 1172	4080	msedge.exe	97
PID 4080 wrote to memory of 2940	4080	msedge.exe	100
PID 4080 wrote to memory of 2976	4080	msedge.exe	99
PID 4080 wrote to memory of 2940	4080	msedge.exe	100
PID 4080 wrote to memory of 2976	4080	msedge.exe	99
PID 4080 wrote to memory of 1040	4080	msedge.exe	102
PID 4080 wrote to memory of 3400	4080	msedge.exe	106
PID 4080 wrote to memory of 5244	4080	msedge.exe	107
PID 4080 wrote to memory of 3240	4080	msedge.exe	108
PID 4080 wrote to memory of 6012	4080	msedge.exe	109
PID 4080 wrote to memory of 6012	4080	msedge.exe	109
PID 4080 wrote to memory of 1668	4080	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\__MACOSX\api_olivetree\application\language\english\._index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffa79f7c188,0x7ffa79f7c194,0x7ffa79f7c1a0
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,11082090924426402840,13051758266483310930,262144 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,14162021357194727113,1830845353170109009,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,11652238194432076447,10021429847896582985,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,9701003565346584766,8136612769018288387,2097152 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,9987773059523270178,3368769302881720034,2097152 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,11592633183767086992,872526010617423129,2097152 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,2721358476550616372,3348495112093873400,2097152 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,16191672180304421861,16274974695360861548,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,1959220837839595874,12401577796261748916,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1301579124453124481,15256102763755342266,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1301579124453124481,15256102763755342266,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,14458861662367638575,17579504910594324686,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,14093883567512054440,8855833566715465861,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,16567763940800172563,7198670319987627125,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,2059186102361650293,8846737956194239178,524288 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6468,i,5718768075231313302,5843307517911191616,262144 --field-trial-handle=2692,i,1783976466165114628,8369380177310746181,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a4d18fbf06682f5c1394cdf715c830325992876394f23b7ca1ef65ff58f88dfa
MD5 0304947e0b408c629bf67ad9f1fc866a
SHA1 c2a9a8e05f8906cbb77d566ad7155abe61eca238
SHA512 0e5613dd33c8ab1cb1ed65db3ef34c0af2ed1be147c8e55a4ba98f1d674a57e3cc4338b56ce2b0425f1cdb111ae5dededa804f8e294acc037686b45a8adaa43f
TLSH
T16741A96247B714C2F79499B261E54CCAFEF5949666C74E838CC3AE704C22F2564D30BB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bd1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bd1c.TMP
Size 2KB
SHA256 574b632bbd8a59766adb8263c9667092a8aef3df4c847b6174f8fe36aba3156f
MD5 48969aba85cbb9da0caa3dc13429c5ce
SHA1 08259370eadd69dac7f399b7b55b807e3c93a74d
SHA512 b3e5f98a9f02dac1490fe7cfcf7fb90f51e804917185158f94d609733a03d3051a0f21084d7afcde40be4084c28407ebf4203f84b22f4e8355dcb3dd939e8027
TLSH
T13041A96247B714C2FB9498B271E54CCAFEF5949665C74E838CC29E704C22F2564E30BB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e32a032321439308e2faab69cbe57d89688f202161ce36ea4856c716ad00075b
MD5 22de7fe645d9d90d511abd4a9f2aee71
SHA1 ce1f0cce2fbb9da4779ce0e66f228b9c6f8fa28f
SHA512 2f493d396da80447dd3d4e2ddcc2c4594d23154a123cf9effec75ff2836a3a4115cdee4ed5c28e31bdaf5780f0caabaa03b82d00e35440a57389a241a448b2c6
TLSH
T18341CCF7C3E8856E890156F0AA14AE1BCE2D0915832C3C5AC9E4EF2B93E3871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2919cb51518a233b5b08084dd541e9fb43cdd3f30c75dd17d28ecb95736217ae
MD5 4f696f4c63861415be041ef45ea6eb88
SHA1 540bd9426899ac634345acabb345714085cb5b7d
SHA512 c542b4a19e7100968ca353d480b6e7c111ac8c8abdd9cb1aa49e15e9f6829ce802d864d79036d6acf78b0561b43afa9f8ae3feda679aafe6338cf3e6a60ae3e3
SSDEEP 192:sxRHRDbN/fNsNXHm2Sm7aUSzoD8p49/g6+WNIY3BL7GnIgIJ:sxRH5N/fNsNX2RA/5IAes
TLSH
T18432A816AE28A93B8CCBD21DBA657F53D6FD5032A1D05E58B6FC861C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3556eaf93bc2ec2eb3c60b8fe6a09386d0f96d5c4388395659576cf1105b9235
MD5 942325a88866363acd8ebb08f3ac3fd3
SHA1 a27f66891555081e98efc87faba4aab7bc901e6f
SHA512 5171254c95d455c1b3f803b05f0e1c6b37473814808ceaa8f064897c94abe30d5f076dea44b71f90d06c5185a686b4d18a354284cf3983fe3677b0440924e7d6
SSDEEP 192:sxR0RDbN/fNsOEHm2Sm7aUSzoD8p49/g6+WNIY3rG7GnIgDWJ:sxR05N/fNsOE2RA/5IM9u
TLSH
T15132B81AAE28993B9CCBD219BA657F53D6FD5032A1D05F48B7FC8B1C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7b7fdb5285d0726d381a78589575ddb648a4709d69d528522082c8876e2ad33b
MD5 0cfe58be2d4d5b3a3ce31e69a1225e5c
SHA1 79abac2ad725e77e1fbd44c1e7ae7ac4ea5fce81
SHA512 2112cce67a5a44d7e8230c811e87339a06b59b4c8032d91225bd5a897369e0de020a6f91e506ef6edd45c3248e9c1183d4dd875634be0f4f3f042e129afde37b
SSDEEP 192:sxR0RDbN/fNsOXHm2Sm7aUSzoD8p49/g6+WNIY3BL7GnIgDkJ:sxR05N/fNsOX2RA/5IAeU
TLSH
T1BC32B81AAE28993B8CCBD21DBA657F53D6FD5032A1D05F58B6FC871C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 04db4b80e8d4b81eb0d9ead25ac255b18f7ae8ce9dcfa090012554b6df837a4c
MD5 efe0dfdb000b7a68facdcd51c5a23023
SHA1 a8f54d27da4bdb45899986136a3042de3bc6e00c
SHA512 b14e197b8e5ab9fff28a10fe72d854c56dec5d06264750aaf216fbccafb40faf99177fe37bd25aa201df4bfd7262ccc9e53255417a405a75aa11bf0695963cc3
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RTOroOLc:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0Vm
TLSH
T1CDB2DA2F600DCB7E5F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 73cb1941e87f1091f69249fdddb870375bd6b3deeedf52d3a3368ef01d8fed25
MD5 c30cb7c6d96b0b91b17ffd2204f85c29
SHA1 a19453ed68c3144f3576d524719824ec337df04c
SHA512 2cdaffa7eba3ae7808eb2430bbc866c352d997097c507885f717bd71f31ef4ceb484e939ea213a3db56b59fe7737c1f095bc3ef000b43770c69ee7f58d638c68
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHyX+SkE0SWcJhgCSK4Xg4ScCqRrOkKnKy+:C1i7PF/DWrwfX9mgpct1o7zsHyX+SkES
TLSH
T104918552317B0690387E690CD2F9982B92C274673148F82B3FA905E29F27E038DFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 676b26e7d8cc73c4c70b04f10ddcc9969fe3938253888a269d90a8447c22d008
MD5 47898c8768037bd25dd68acdd57360a1
SHA1 8df5366a89e80f5c20630c55841c14a6c14bbea3
SHA512 aac8141a7efc53ecefa3f89a8d231f979744d91f64c6bb2806aedad6c0b93bb0a1ba31e951daf920b9ad38f8ec5b25b66185967445d1e1a8ed537906f3076ea8
SSDEEP 768:wrv+4UNbdo3mdohc+wfZO2fwEfweuNvShCQR02bwWv:wbsb63Rwfhf1fAvSg0wc
TLSH
T1DF13CF36E974A9339EE79248B60A7A53BEA46173C8C54B44DACD0F0D018769F231FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 932ddb7a0a595524a2112370923f07d7912f5795aeea1b417a202326817c0599
MD5 3208fdab727fc498cdf6cd6e38687a91
SHA1 8893640ffdcfeb5bbcc31b9648bf58332cfeeb18
SHA512 23b7dd802abb5e820b56fc30c7690814330ec2c0b538cdbaa36324f9d2dc1b389d733c524ea7707d0449422e054de46360a0fec85baac24d150d5eacef4d6d49
SSDEEP 768:8rv+4UNbdo3QdRhc+wfZO2fwEfweuAvShCQR0+9:8bsb63Uwfhf1fzvSg8
TLSH
T12903BF36E87499338EE79248B24A7753BEA86173C8C84B54D9DD4F0C42C769E271F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6b71538e2a91657abab5b1d2c8a7e4ea7d73c4af3226e1ead2cac52686151e0e
MD5 eee54e0fa886ef47b4e9a25b43268133
SHA1 8cda044f28778de3273e4e012cca4f380251e24c
SHA512 bfc0cd6cd167b0470055fd32aec6bc2aa423933c3bb586716fa69cefe1e837ea6a451959db6b8f6dfe7fe74505e397d91e7e033b584a079b2bf923ca657cc5f1
SSDEEP 384:iZcIz38NjBicdEFB4ccHGfd+UJfRXOVyS5MfAXEfAX8JuV9vShCiDBTayppFJlmY:Qz3idRhc+wfZO2fwEfweufvShCQR0+T
TLSH
T176E2AE75DC7199338AEAA249B7493712BDE46133D9C89B44D9DD4F0C01C3BAE171B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c82e4fa5a0504272099d22e8de9bed31d7ffa43b4ce0e29a57b9098520df2db0
MD5 9498b1d42677a5e9bb414122be965557
SHA1 d62699d176164da031a3b1a0488054c19c041f90
SHA512 45796780f753073c484088fcfcd80bf94cb5cedf5417bc5616a4bb7a123db928a5a3bd265bf0547bd028260844021d7c31c218f19d69e0adaa8066496ba4d0ec
SSDEEP 384:aZcIH38NjBicdEFB4ccHGfd+UJfRXOVyS5MfAXEfAX8Juu9vShCiDBTayppFJlmY:YH3idRhc+wfZO2fwEfweuAvShCQR0+T
TLSH
T14FE2AE75DC719D338EEAA249B7493712BEE46133D9C89B44D9DD4F0C0183BAE171B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bc329a1a3b4b0e8faf43c76e453f27b9c2cd871a2893b1ff5256fdc9f4136e68
MD5 f854ec3e1f515780e2cc70720dc00141
SHA1 e39eef9f2b9c047c0f05a2e7827da4a1c1d74c6c
SHA512 da334c0514bae6b1509605e32f2d3e5c9ac0095d814a9658b5ccda0138ddbd2f93efdc6342645babe05aa932bb6884d1eadb79b134ed5a5b9653d623dd6a3237
SSDEEP 768:Rrv+4UNbd43RNkc+wfZO2fwTvShCQt62bwWV:RbsbO3RUwfhfSvS+0wO
TLSH
T18303CF32E86899339DE792487646BB63BEB86173C8C54744DACD4F0D018369F370BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58f988df-85f7-4e31-9342-5aa595ee2e27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\58f988df-85f7-4e31-9342-5aa595ee2e27.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download