8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/__MACOSX/api_olivetree/application/libraries/._index.html
Size 222B
Sample260729-xmfddsdc53
SHA256 8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c
MD5 b1ff28ad21b92cf42f82786c95985de6
SHA1 2e2d4d82a1c8831959af1d85a10c0a811e5701a1
SHA512 02ae858beaef74edfc017837ace8e711c10e9e6b5b66db3cf8bd1b08168c3ec42444658a5c78cf2ab6b08cdaf42fb8bc49f36dabab83f566c28adaf25191a129
TLSH
T1A9D08CF021141D46DA55C2F22986A8D02B36B4B4C2671377744EA0403B40A51B7F0307
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4604	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298252272173464"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6EB53957-391C-4BEB-BB94-B1C66B33B673}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4116	5092	msedge.exe	84
PID 5092 wrote to memory of 4604	5092	msedge.exe	85
PID 5092 wrote to memory of 1432	5092	msedge.exe	86
PID 5092 wrote to memory of 1432	5092	msedge.exe	86
PID 5092 wrote to memory of 1432	5092	msedge.exe	86
PID 5092 wrote to memory of 3516	5092	msedge.exe	87
PID 5092 wrote to memory of 3516	5092	msedge.exe	87
PID 5092 wrote to memory of 4056	5092	msedge.exe	88
PID 5092 wrote to memory of 1216	5092	msedge.exe	89
PID 5092 wrote to memory of 4056	5092	msedge.exe	88
PID 5092 wrote to memory of 4056	5092	msedge.exe	88
PID 5092 wrote to memory of 1216	5092	msedge.exe	89
PID 5092 wrote to memory of 1216	5092	msedge.exe	89
PID 5092 wrote to memory of 3624	5092	msedge.exe	90
PID 5092 wrote to memory of 2088	5092	msedge.exe	91
PID 5092 wrote to memory of 3624	5092	msedge.exe	90
PID 5092 wrote to memory of 3624	5092	msedge.exe	90
PID 5092 wrote to memory of 2088	5092	msedge.exe	91
PID 5092 wrote to memory of 2088	5092	msedge.exe	91
PID 5092 wrote to memory of 4596	5092	msedge.exe	96
PID 5092 wrote to memory of 4036	5092	msedge.exe	97
PID 5092 wrote to memory of 4596	5092	msedge.exe	96
PID 5092 wrote to memory of 4036	5092	msedge.exe	97
PID 5092 wrote to memory of 3936	5092	msedge.exe	99
PID 5092 wrote to memory of 2112	5092	msedge.exe	103
PID 5092 wrote to memory of 1140	5092	msedge.exe	104
PID 5092 wrote to memory of 3916	5092	msedge.exe	105
PID 5092 wrote to memory of 2984	5092	msedge.exe	112
PID 5092 wrote to memory of 2984	5092	msedge.exe	112
PID 5092 wrote to memory of 3568	5092	msedge.exe	113
PID 5092 wrote to memory of 3568	5092	msedge.exe	113
PID 5092 wrote to memory of 1540	5092	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\__MACOSX\api_olivetree\application\libraries\._index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaa793c188,0x7ffaa793c194,0x7ffaa793c1a0
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,2766168558892483967,10463347993471936290,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,8454594200859170206,3712985295188311402,262144 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,10240908171081119207,9308768296145396406,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14377385222769399149,10991663865668588829,2097152 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,5782541233098586632,11582974093509187659,2097152 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,932656366373851369,2627581784509149430,2097152 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,4852574200400742259,4758068218589878895,2097152 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,7759482832961367706,14638230340535807482,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,8024999143968285780,14731895751311807811,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,18129679033977757781,5521828702652495703,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,18129679033977757781,5521828702652495703,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,5549122539807604246,5424447855353615824,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,9996704993667893817,4203777272526244176,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,5101726689030468521,4188593774404709562,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,4856887957523426142,8832485392494907279,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,756732517292855375,8573886564673375327,524288 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2828,i,6068730239937087545,3878713323149525741,262144 --field-trial-handle=2204,i,7826124156278089884,13146099473550828608,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5cae553040b1c1a0382e4bce6e77dd25fdbe1bb2ebf807ec3601095d4af5bc45
MD5 21f435c979462a5c5c91dec3b206b424
SHA1 1b11b4cdaa98e58c75d521af8b8063b88e496090
SHA512 ad01eeb3f18e6ed8899fb36e19f500fb93460eb30605c0ea3db88ea825d33a7edc1b1c205f20007945fe0ac36d2816dd7d7df797e07030c52981438f2a035958
TLSH
T13271A43B06E26CD2D39047FD74DE1AF5747345DBFD8F5EAD12209A3036237128229564
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5853f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5853f7.TMP
Size 3KB
SHA256 ba3875c19de74f0c466041d53da203ebf1bf55f37a4e0296f6441970e501b972
MD5 7e8327ed53c4ba3501bcd1df7d957688
SHA1 92ae121a2ed869da8800a6ca9508e8ada2544131
SHA512 f8d0a40108419aeba5a87a16347193743b8a7d7ecd1b4ed5aaf496f5dec9d186968c048c8f15c0a78be2ddb76b0573d2694ebb213793ee84d0e1e0adf6f19f22
TLSH
T18271C53B06E26CD2E39047FD74EE1AF574734ADBFD8F5EAD12209A3036137528229568
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 76fa957ba252cd3ff905a9150c6904dda8aea8e9e537dd157f60ed60e12843f0
MD5 a923ee5157a33dd1432cd182ef7ad605
SHA1 d22585ac82a3a394c6a70797b6e7e53d10877e03
SHA512 33306c095af835cb23fe845976c1e072681568c89593f1ee4596918f4109954174f3e2791e164de00984aff89302ca86dbc355aacec9f79dbe0a73c9aa6cdd86
TLSH
T1D4117DB3C3E5956E8A1117F06A24AE2BCE2D0506832C7D1AC5D4EF2B93E3475D10295B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bdcb0523351b0255afd24ffc5300e57091345364b6029ef9f8b27d14c56f6871
MD5 eea7d2e8bc1e0f89cfe0811edd9b5996
SHA1 03059590195de089602313c841c5aaceb0725049
SHA512 a14710b4b3ac0aa40a5bab8bd0bebadbabecb0e1eff56de7095d958d962319b61448dbd8440d1ec8870f4f40deefa9d66df7b79f6a2ad8f60ec6a2425d4df301
SSDEEP 192:sxZKR4yM/jK1Ml8Mkx/f0sQe1Idpd0HW6+WNGYIkyTmIgrJ:sxZKKMx/f0sQeGKHbGk9
TLSH
T10842E716AB349977CDDBD209FA557F53D6F90472E2900E44A9FCCA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cfbdfb325775a42426c3653540aebe922e1245ff737dad5ab9777306341450ce
MD5 62f31bb7e2029adf735e30187795bbc2
SHA1 8c874b8d32662e2d1a26cd39f00a1e8df6296f11
SHA512 9e3365b7a6db9c5472e0412beb7424ee1cb3a3992effa81b8cab4fe1f89e1726fd077f7d190ed829184d219544dd5116555a816caea1641bbfd157f9593a3ab7
SSDEEP 192:sxZKR4yM/jK1Ml8UQckx/f0sdl1IdpH0HW6+WNGYIop2mIg59J:sxZKKqnx/f0sdlGUHbGaJ
TLSH
T1E252D616AB349977CDDBD209FA55BF93D6F8047292904E44A9FCCE1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a7741f16d1d45a3ef166c380b3fe22ea21f4437e89a727f60bcd44e788700cb7
MD5 2958575a97108c4824abc7bf3732e8df
SHA1 220c5bac38f5c6087c01fb1b9907cb2b0d2ed5ce
SHA512 88deaedf1a5018db890f491390bcad7af6867e8d398a3ad6cfdbd567fd2d137fe2ebf52618ad532cccad9fa9fe29fce891255a69312a3ca04aa23b15ef003ea6
SSDEEP 768:VNsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR92rov20:VNsqxXlWvJD6Tu1ja54LAs9NvL
TLSH
T1B6D21B3B694CC77E4F840E9CEC266FD66ED801CBA6988D5447FA880C03CB7EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3ea5ba2338b428ee939542927efd53df9c08ddd155d9ea75b97a3535bead0eb6
MD5 3ecb049dc50a9c8bb4fc25cb3f99fdfc
SHA1 bc51b6502b7f6499efc03e1b84a9fa8aec5d9274
SHA512 e79bbb91d2b989abe23521049f4e0a359d0243e43cd0e47ee391856b148064db19c280ea45fe695743a7f8a004014bb4ffefbfbe3d20161cb04edcc005f79bd7
SSDEEP 96:KYbaKYIKOBOKyw6aEAKdieH6KYUOWb+KoEI:ExthXc5hR
TLSH
T1BDE10722737B0242387E290CA2EA95378E4137633818A56F3B7840E54E67E715DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b2c031a2e2247064a694ddf3781379689073ecb0f329de6f5989a410e72c2b9f
MD5 55fe1aa188d09637c4fce8bad3fbf4a1
SHA1 015ee66188a440db25b1e7109c72cb68e4a4cfa9
SHA512 6e7871d5dfc4efc89d0b44355a40da97945d405e821739972c048afcdc89c400a24e2a74add5d65c4df5b0cefe88dbed47c78fa2ecba313ac7a217ff357ca195
SSDEEP 384:9ZcIhsNau5yblo6VRNwOqp9UiD+Scjmw7V:lhGIHwOS9UiD+1jnV
TLSH
T1BF927D36AD349C779AAAA146F98736138FB89073D6C81F80D5ED6F1D01DA9AC0307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5a7afbb46d05b9949f720f194e3c60d538e48ee9809b571b45fe0df761bd073
MD5 001f8de29442de0ee6697ec41b4b58c0
SHA1 8a5f95a8c5244b9573c6d2d551b07950830dd9e2
SHA512 b0b2d82a650c653988d246d8a3381f543748339a93cc5e7b42bec4493f8d26baf68e53069f84230429798044ca65297ab409a59e24588a451ba58d9c19ba287b
SSDEEP 192:tONA6JkRtQmiUyDoW+RNwOm9OmGh34RMU6:tONA6UrrW+RNwOq6PU6
TLSH
T11A02F9357D385C7B8EF2AE09F98B27135FA8202BE9852F80DAD81F0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2c317b2711ab51312b66ea8c75a5972015e2514bc1010c469779a70111db93a
MD5 69d9a3f4b07cc0ae2a48e1b59d25167a
SHA1 d027eeee7fabd54d5dadb878a9673679f408f939
SHA512 56c75d21c541ed0dbbd9d585d16d398449bb72982612fe3adcd98fe4a6786597c9b52a973d00f67ea28d40ebf5dd232fdc6e19c81098a39711b4449643ce0fa7
SSDEEP 192:KONT6JkRnQmiUyOom+RNwOm9Om3l9UiYVccqH4U6:KONT6UJkm+RNwOqp9Uiv+U6
TLSH
T199123B36AD389C7B4FE2A545F58736134EA85127EAC96F80D1DD2F1C01DFA9C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0e11a8c2b5cf426e607167acca4c4229fd524775fca6296bb0543b4ceb7bf00d
MD5 42cd1081fc86ae25476973b86509190b
SHA1 586e2be2ca0ad4c2aeea015addff569e66e46877
SHA512 d3c5750b171b19f30994e5fde07ef1521e05244522b97dd94740c41b016ae68c390e3130218f50b487130d16a0503e2a698b4ca1b97eeb20c50855069cd0eb91
SSDEEP 384:3ZcIhsNad5yblo6VRNwOqp9UiD+Scjmw7V:/hTIHwOS9UiD+1jnV
TLSH
T124927D36AD349C779AAAA146F98736138FB89073D6C81F80D5ED6F1D01DA9AC0307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e33ff40f01c9c35a95fac748960b7478bfed6c39c09ff9f6100fe59142db88ed
MD5 978253586fefefcd52729d253faca293
SHA1 52e7c55dc81410a673019c800f10094928b4211e
SHA512 dd64a90916ea1584a69cc2222c63c815e5de407776ab683c43be25bebe354567dbdb378a35aef905402c09366e2dc708d74fe7f1b274edcdcb6d1d6242164b23
SSDEEP 384:IFiZcICzsNi8TUNTUlIld5yblo6VRNwOqp9Uiu+Scjmw7V:IFQKPwgjIHwOS9Uiu+1jnV
TLSH
T1A6A27C379E64887BAFFA9645F98A36138EB89073C5C4AB90E6DD5E1C00DA5DC0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9852b7cfe2f91fd83300405e0f7ec18542d23ca2033f5dbc09a8aea529483ef9
MD5 25c44da96418aaeaf5ec68a277e7388e
SHA1 bfc6bfe681343787690431e3ad3b5f81e27723f0
SHA512 b309adca91da417000ff8095b601ede9a1b11e2120d7a80d52ce5fb9d228ea2d6c30bcd0d6d039adcced0eafd267a8a43b98a3a18e2674d842af25577d12bb0e
TLSH
T1DD412A5CBBEA1158B3B36E5A9BF6A86D887BBC772F06D45E10110D4F0632B40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download