8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/__MACOSX/api_olivetree/application/third_party/._index.html
Size 222B
Sample260729-xmfddsdc53
SHA256 8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c
MD5 b1ff28ad21b92cf42f82786c95985de6
SHA1 2e2d4d82a1c8831959af1d85a10c0a811e5701a1
SHA512 02ae858beaef74edfc017837ace8e711c10e9e6b5b66db3cf8bd1b08168c3ec42444658a5c78cf2ab6b08cdaf42fb8bc49f36dabab83f566c28adaf25191a129
TLSH
T1A9D08CF021141D46DA55C2F22986A8D02B36B4B4C2671377744EA0403B40A51B7F0307
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298252440992642"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{2B86F549-DB7F-423C-BC3D-EA4878B4D486}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4132	3756	msedge.exe	83
PID 3756 wrote to memory of 820	3756	msedge.exe	84
PID 3756 wrote to memory of 1596	3756	msedge.exe	85
PID 3756 wrote to memory of 820	3756	msedge.exe	84
PID 3756 wrote to memory of 820	3756	msedge.exe	84
PID 3756 wrote to memory of 4148	3756	msedge.exe	88
PID 3756 wrote to memory of 4148	3756	msedge.exe	88
PID 3756 wrote to memory of 4148	3756	msedge.exe	88
PID 3756 wrote to memory of 552	3756	msedge.exe	87
PID 3756 wrote to memory of 552	3756	msedge.exe	87
PID 3756 wrote to memory of 2052	3756	msedge.exe	89
PID 3756 wrote to memory of 2052	3756	msedge.exe	89
PID 3756 wrote to memory of 2052	3756	msedge.exe	89
PID 3756 wrote to memory of 4348	3756	msedge.exe	90
PID 3756 wrote to memory of 4120	3756	msedge.exe	91
PID 3756 wrote to memory of 4348	3756	msedge.exe	90
PID 3756 wrote to memory of 4348	3756	msedge.exe	90
PID 3756 wrote to memory of 4120	3756	msedge.exe	91
PID 3756 wrote to memory of 4120	3756	msedge.exe	91
PID 3756 wrote to memory of 2388	3756	msedge.exe	96
PID 3756 wrote to memory of 2388	3756	msedge.exe	96
PID 3756 wrote to memory of 4224	3756	msedge.exe	97
PID 3756 wrote to memory of 4224	3756	msedge.exe	97
PID 3756 wrote to memory of 2884	3756	msedge.exe	99
PID 3756 wrote to memory of 752	3756	msedge.exe	105
PID 3756 wrote to memory of 1800	3756	msedge.exe	106
PID 3756 wrote to memory of 4860	3756	msedge.exe	107
PID 3756 wrote to memory of 2544	3756	msedge.exe	108
PID 3756 wrote to memory of 2544	3756	msedge.exe	108
PID 3756 wrote to memory of 1920	3756	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\__MACOSX\api_olivetree\application\third_party\._index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc5d11c188,0x7ffc5d11c194,0x7ffc5d11c1a0
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,11803857965056207306,11826818251934114035,262144 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,8081489362483253636,9108409158136319313,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,18141937676125208057,17577735860100568073,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3344,i,9158139506186602728,9655286758675613241,2097152 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3348,i,15653628873978232898,17490423426986296638,2097152 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7495061107479817348,7379474424264485068,2097152 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,7898660701158661036,5766623905036940318,2097152 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,3015562515502672836,17245032581799072101,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,12309955821910227125,4707741385210458287,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,15767110663592576433,12313426828935948519,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,15767110663592576433,12313426828935948519,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6043707920579705970,13492026041238556180,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,12342806041321312958,6134852374199965530,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,4792810609951040499,9663607175763815324,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,17203441488742721608,9587974954106928678,524288 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,17324962683508522542,9795192676531788081,262144 --field-trial-handle=2264,i,11835176658738161123,12264533263777824354,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 04916ad107b351bd8ad48a6d75ad8abb2807177b7646268ee8aeb4f71811ac75
MD5 e8721d987c1eedc1683ce34013b5f098
SHA1 dd2adc06e87378fcd1f39c74d80b9ed8f8d14320
SHA512 a65918b478019236e8c4b83503d3dd7fd06fb6ed241ada0e4776baff07b76b532c19636eefca9a0eacbd63898f368a576fcdf6a0b3ddc64ff0dcf248eaf7810f
TLSH
T14C714EB7034D14E3EB631D31ACC20AC678BA90ECF6377E961070DB35C52533101E9659
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588a3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588a3a.TMP
Size 3KB
SHA256 9914f40bcb9102fb301d13d6fc1ded80b46e84d696379d99746f444bc7431b7d
MD5 c7c54577acb3c1c25311a7a831f05b0f
SHA1 c2a06c98522e506d82e1e92ac6d4bd26a0a3069a
SHA512 7cb418b8ae31321ac0dbf9879f49783eb6c449edaac5e8c7f36032e683565003085e2228fde72547df5f75dbf5000685f10a75ae8e731ed51c4f1a0693832a97
TLSH
T11C714CB7074D18E3EB631C32ACC10AC678BA91ECF6377E9A1060CB35C62633101E9658
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 514b50eedd01fc5ef7dc2a5c5e6ec8186596fe4f0d7852c6e80ee10fb204da39
MD5 6aca6c5eadcff44a93b5891df9b952a9
SHA1 ca4b650890751a07e35294d026c24e4ef20c71ee
SHA512 e089ce0d22df0d052f3067e0e59e5ce96994aafa19d60ea10d0dfadde591d3058cef482af01a0fe34322d9d2e097c7cf429e0f8879cf6717f0615b377ffebeab
TLSH
T191117DF7C7E5856EC90117F06A24AE1BCE1D0506832C7D2989D4EF2B93E3475E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8405f02ef658b03f5c3cc65d4a7e5b48a9b3122a14f1bf34f9d74ef63c006f4a
MD5 d6d489fd649ffe388a900daf24bfd112
SHA1 bb7e83c93d7b0ec8c7751bf782b1e5df7f282def
SHA512 4ba5ec9858673f642777fec81fee7150cfaec2bacc322a11c508cc13da8baf5238519fb68ece772ab5cf5b993cecb6811d76a92cfde19bb218fb82b1f531ea06
SSDEEP 192:sxZZROyM/jK1Ml8Mkf/fisY0hVJIdpdaHW6+WNGYvr4jJAIgrJ:sxZZYMf/fisY0GMHbGNG9
TLSH
T1C142E616AB349977CCDBD209FA51BF53D6F91472E2900E44A9FCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b434585d4d00726aee583922a76fbc66732146310a3e1a62d2763804fcc1557e
MD5 b71a189a481bb0c0ca97c00f6e8ac257
SHA1 0433273769b6ccdb48ad50c3b116eb97b1b81bb0
SHA512 3560993ba52aade514df5f92f29dec72c7bc31fe3e34c9f712c41202f4ce5adc2439d59463b07c90777d74ad2f752765f265e21ac4e8bb61859364656251c62a
SSDEEP 192:sxZZROyM/jK1Ml8UQFkf/fis+rhVJIdpHaHW6+WNGYvWvjJAIg5uJ:sxZZYqOf/fis+rG6HbGFGY
TLSH
T13B52E716AB349977CDDBD209FA51BF53D6F85472D2900E44AAFCCA1C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 90fa526614e8331263fa973be813a8a0144428cfbe58ec7241d99025cb6e659a
MD5 16159782069aa5b366389b98cf980e99
SHA1 e14fc7d9a46110a5893d4019eb5c759849937d29
SHA512 6f32bea7d0e1258dd095181e72655c18ec04870d1f9b9fc761d17d2acd93bc82896b61eb3e4e62bc60200e57a5b15731ba4325bdf612c971d189ada2834a93d2
SSDEEP 768:dxseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppyro3a:dxseJ3xWvhfynu1jaVcL88ppK
TLSH
T15CD20A2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f9f4d8b601e41b14dab50089d2ab30eec28ad5492ee743c47e04344d9e374189
MD5 2f95417350bc8cfe894e800ed4ad7a52
SHA1 fd4abd2706eea15671c5e0dc7e203870f57d4d73
SHA512 1d868878f097d68862e706fc99622731afd1c5cf9312f785c95efb822b90fe33b03d4b860630c39c91ec31d66cead2e5d88129571c903bfe8656213f983de57d
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EZ:KYHIhKggkXyVDIdKYMAPyJiI/KXq03z
TLSH
T1FE911306747A12023C3D2888B2E5D5364F4139A37469A4EFBFB844558E67E220EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44664ad9-f920-4e48-bf9d-ff72573d172f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\44664ad9-f920-4e48-bf9d-ff72573d172f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 05f43f3716c35ae1df4af7e33180c6f84161491d89e69adedadfc738a5b3a700
MD5 41c71ad7f882dcfc588d3a1d01ecb52d
SHA1 01fb3154726c8fd94547c727775282921588b71f
SHA512 aeda286724d3ffe74f385eca3af3d6eeff09910ce2f040575b5e85edc82678fb89fbb47fe43ec23f2a9db8baaca8d0f5273ebedb3d617fdd34cf6ad50e31b5f7
SSDEEP 192:uMm+xasuheOwQxMGsNR2Q6wVMpM7eVjQmiU1vXd4MTH7+FdLJxtQ+2e8z14qIzkN:+ZcIhsNR2lC7mV1y9d9xW+2fezu
TLSH
T115626C729C789C37A9A7B545F48A36034FF8D12BD7C45B94E5EC6F0C01DE6A8130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1cc233b438aa36d8be29ef1b04dcec8882cb27e937e40c4cde4eecc07d737c0a
MD5 0a192efd8b0aee53bfc948bab17d8410
SHA1 458a7004e00feb6579538007977d59a3bcccaef4
SHA512 d7c3a537cb69cc26a60a58a1ee123183c0f69fcd2f86d82fbf24b32e7ee7318eb6f218d83113ea0d46a04e10e0e9a8d1a23dc33108504566ee381d4093d0b061
SSDEEP 384:QiFiZcIczsNj8TUNTUlIlnlC7mV1y9d9xW+23ezu:rFQg2wgqqAEl3ezu
TLSH
T105824C738C64C93BEDBBAA45F49A32138EF48177CAC4AB94F6DC5F0C019A5A8130BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2335a4324c207927c06980bae23c698666a405033257b1b99c5a45af8ebeaef
MD5 77b21e7746ee9212f961b752baee4780
SHA1 d0057d8d2959df72436ac71373f6e86f0a65d027
SHA512 6a00e4c6646ae97bdac21caa960c531106d0ca353c5cca1698d01239fc7c04854edfb720bfa3d9924710366a5a3b0fa4944eb1b9a9666b64d13e8b1ea1075c19
SSDEEP 192:lONP6vMtPQmiUydFThTH7+FdLJxf8473LU/u:lONP6UtRgTmd9xHbU/u
TLSH
T1CB020835AC786C7BAAB3BD4AF48A27171FA4116BA9905B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f07e1a029b8dd5466b30f66e4428aaf5d3be60cf87dd5a1299378a152feefe8e
MD5 2c1e485b10ae759a127a522f635c2874
SHA1 4d250f222601f3a79b223795e13e59b480cb5202
SHA512 8232994381f2fb83ded11faf74600282636043c3aeafd4fca3bddfff2214619fd5298594e46c5b826e17be8fc4a42a861f350742777bbf7b5fd4bdb3f8d3a27e
SSDEEP 192:uMm+xasuheOwQxMGsNRnQ6wVMpM7eVjQmiU1vXd4MTH7+FdLJxtQ+2e8z14qIzkN:KZcIhsNRnlC7mV1y9d9xW+2fezu
TLSH
T1D2625B729C789C37A9A7B545F48A36034EF8912BD7C49B94E5EC6B0C01DEAA8130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8d24392693332a736c6b9dd03b663ea9043a134a0aa5cfeb29a94b7d31a5e0f4
MD5 cbd7ccddb1b8a631995254fff893b513
SHA1 8247435a4931fcf48b6f9836c063deef995a2230
SHA512 157930943822a95990da8f153dad0863a491b3439a48b647fa5ff7d822ff3e186c433247593dab9c6b3a64183dd64829fc4b2143e8f61c6d00b9f8caf5264b31
SSDEEP 192:6ONk6vMLPQmiUyAFuhTH7+FdLJxtQ+2580I4qIU/u:6ONk6ULRXumd9xW+2ueU/u
TLSH
T11E120A76AC689C2BAD93B546F08B32170EF4926BDAC4AF50F6DD2F1C01DE65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a5fb6cf-03de-49ed-88f0-a715b8b6401d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a5fb6cf-03de-49ed-88f0-a715b8b6401d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef6772d448399bd13955240b67d9838a59abe2547fc9a27ee5fc3aca3fac9ad4
MD5 4bff66173ddd788b37256912ecb1bfc2
SHA1 840db4aaa192c6c23cfd43bc7016d21f6b9d4770
SHA512 d82d912038cedcdd7db8316038e49923af83f33cbeada92492ed4e2c4ce1cf8a2bfbbd852782199f549111d109e05516f851c62c70c5b343a3e1cca97591ef84
TLSH
T13C411858B6E91108B3B67F1A9BF7A86E4C7F7C772F06956E00010E4F4A62A00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download