8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/__MACOSX/api_olivetree/application/controllers/._index.html
Size 222B
Sample260729-xmfddsdc53
SHA256 8991664e10f49d768e4d100f6b29aad87e96ede0f040925b87487b81abcb048c
MD5 b1ff28ad21b92cf42f82786c95985de6
SHA1 2e2d4d82a1c8831959af1d85a10c0a811e5701a1
SHA512 02ae858beaef74edfc017837ace8e711c10e9e6b5b66db3cf8bd1b08168c3ec42444658a5c78cf2ab6b08cdaf42fb8bc49f36dabab83f566c28adaf25191a129
TLSH
T1A9D08CF021141D46DA55C2F22986A8D02B36B4B4C2671377744EA0403B40A51B7F0307
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2336	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298251950953046"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{1315D5B3-0B8D-4AEE-828A-B4B0A0D8FB04}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 5572	3500	msedge.exe	88
PID 3500 wrote to memory of 4008	3500	msedge.exe	89
PID 3500 wrote to memory of 2336	3500	msedge.exe	90
PID 3500 wrote to memory of 4008	3500	msedge.exe	89
PID 3500 wrote to memory of 4008	3500	msedge.exe	89
PID 3500 wrote to memory of 5112	3500	msedge.exe	91
PID 3500 wrote to memory of 5112	3500	msedge.exe	91
PID 3500 wrote to memory of 2108	3500	msedge.exe	92
PID 3500 wrote to memory of 2108	3500	msedge.exe	92
PID 3500 wrote to memory of 2108	3500	msedge.exe	92
PID 3500 wrote to memory of 6048	3500	msedge.exe	93
PID 3500 wrote to memory of 6048	3500	msedge.exe	93
PID 3500 wrote to memory of 6048	3500	msedge.exe	93
PID 3500 wrote to memory of 3248	3500	msedge.exe	95
PID 3500 wrote to memory of 3248	3500	msedge.exe	95
PID 3500 wrote to memory of 3248	3500	msedge.exe	95
PID 3500 wrote to memory of 4836	3500	msedge.exe	96
PID 3500 wrote to memory of 4836	3500	msedge.exe	96
PID 3500 wrote to memory of 4836	3500	msedge.exe	96
PID 3500 wrote to memory of 2912	3500	msedge.exe	98
PID 3500 wrote to memory of 5176	3500	msedge.exe	99
PID 3500 wrote to memory of 2912	3500	msedge.exe	98
PID 3500 wrote to memory of 5176	3500	msedge.exe	99
PID 3500 wrote to memory of 5972	3500	msedge.exe	101
PID 3500 wrote to memory of 2460	3500	msedge.exe	105
PID 3500 wrote to memory of 1388	3500	msedge.exe	106
PID 3500 wrote to memory of 3608	3500	msedge.exe	107
PID 3500 wrote to memory of 2672	3500	msedge.exe	108
PID 3500 wrote to memory of 2672	3500	msedge.exe	108
PID 3500 wrote to memory of 4532	3500	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\__MACOSX\api_olivetree\application\controllers\._index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffc2c53c188,0x7ffc2c53c194,0x7ffc2c53c1a0
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,3662630569230501082,9505721603978360358,262144 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,14862445960294274204,17270545589312295359,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,2052084793643320836,3952955589958338598,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,1045330181703264847,16172028818438116295,2097152 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,17456178561885119393,18059495013807285785,2097152 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,12960317653612858007,10243332593522534539,2097152 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,9074785039189488883,10214219777863065906,2097152 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,6245789693007378060,13624463582820029558,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,9759209038545096873,14604335058511782113,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12584017687049815307,120225882421508337,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12584017687049815307,120225882421508337,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,16781189433668708660,17783000501766626101,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,4425122217283269598,8724151062508965989,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,17982073429750345893,16409157965195977694,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,11909230348321171281,1616714220279493473,524288 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,16812055898558496012,7465840466797674666,262144 --field-trial-handle=2768,i,16533407850349105745,605714241616396980,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5bbe5afcdb710a3e185e5419e308384b2a080e34cb1f680bcc0e17ab5b9f7804
MD5 2a2252424af3761a390476172dc6ecd3
SHA1 a2493732cf886b37b6f91719e84b181102b11659
SHA512 8f9c9741257022ea4ccb2bc03150d8a93b687dbbc47380d2b61d7e3e49f730cd5e28e662e501503364efa6a965e24a5c3e23770d7efd69eeaa47d3b962946789
TLSH
T129516F90136E0FF3EF368FB344F94BD9BFB5980A823B1EE000F0A078495AF295019425
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fa44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fa44.TMP
Size 2KB
SHA256 5b8478f1a2e827b27850cef223e63159949b9b67225c3cd88a8d3a16db50767a
MD5 bf95c64027e357250ea055ed7a6ca855
SHA1 0265d27b247b439436503c233fecf27c62a7c2d5
SHA512 f3d14098cfa03f80dc66b8eff5f6d0163b3def985662a18a19a5c75745fb0d7d8f0105a69614a2595efea22c27102bf9d95ecbde2e759db3526418689e85813b
TLSH
T14F515094132E0FF3EF368FB348F95BD97FB5984A823B1EE100F0A078495AF296059415
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 096ca899ae401e80fca6f97c6a4afb2ca1065e6791be00249f20b2d6071d79c9
MD5 a7b5173023d86aa3307e9c8502761c26
SHA1 70a0c14e63618b569c6ea3c662cd842718b01482
SHA512 1d3f95185cc61fcf0b85b37e1faee31c4ff9d1037c85814589f5e7bc107b2492f72dcca29579a2733c66ee2b3888d317673562e6fcdf18bffb36bac6e977742a
TLSH
T18A419BF3C3E4896E890156F0AB14AE2BCE1D0915832C3D1AC9D4EF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8ef02b310aea31e638469627bc7852db93969c4168fc312fb41f5640eb41da75
MD5 c30fdb7c2533f6b269e5abdd673d88e4
SHA1 bc500a5238a1e111ed8711bc107f4da62756a71c
SHA512 9b7512c6b59671b609bf507b3b0ab978fec9de31f1bcbe60a40dc2f1324a62ea40ea9662df13001f7f53e0c094495e273b6b3958608a2cb3364096dc78c7b4ad
SSDEEP 192:sxR8JRxba/f+sIx/PZzoA8p4g/g6+WNIYZ7PK2nDGRIgIJ:sxR8JHa/f+sIx3kV/5Iwws
TLSH
T17132A8166E68993B9CCBD21DFB25BF53D6F95032A1D45E48AAFC871C04EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c20f751d68a99901fddffdb11361073a3e1ed1f315cb77d446fd632c9e2880d5
MD5 47c5d416c85c90835b26e1371a2390f0
SHA1 8bfdfc238e40aaa9bb84a1cd180fa487e5533d1e
SHA512 de635d20c006752928a4201995e7a43561c2a55ab9451a330cd66de5284b8faf533159fd6556d3d78f2ccbeaf59ac983132070052151b0092ac10087ff34c452
SSDEEP 192:sxR8yRxba/f+sjFU/PZzoA8p4g/g6+WNIYZ7PB2nDGRIgD7J:sxR8yHa/f+sjFU3kV/5IDwJ
TLSH
T17042CA16AE68993B9CCBD20DFB657F53D6F95032A1D45E48AAFC870C04EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 75a74e57a065ec1e2a8424bb54fbbad259f90cda60083c9f706043686e0d5fd8
MD5 8fb7db0ea9bcc86213fc410f125d1e72
SHA1 62098606f4b600ea7bc7999a836b3844b9cc9399
SHA512 4d26f32098bc34083fa0382c241a0411790b57a587b8d305aa6af3f812595506bc59846dc13320519873f70bcd52e0c9d9283ed2ba5010ad41f370d817e9e863
SSDEEP 192:sxR8yRxba/f+sjFx/PZzoA8p4g/g6+WNIYZ7PK2nDGRIgD1J:sxR8yHa/f+sjFx3kV/5Iwwb
TLSH
T1A432CA16AE68993B9CCBD21DFB257F53D6F95032A1D45E48AAFC870C04EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 d7853472ab0b3304b30692dfe217314684ff79a35d8c699586bbe3bda4bf82b4
MD5 86c173f6240a90abddbef74740339e07
SHA1 3c6b4bb88c1e545b50bfb0a615895608b9256682
SHA512 d9c0bb55db6adf5e6cde3148c3858d4b27be2de5a1852fb725d82b84307b859d1edabc0e45580230b87a07706e2b17556418743c44cf098a9b0c4622e098ea67
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6rroOpb:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0V/
TLSH
T1BDB2DA2B604DC77F9F801A9DAC196FD77D9802C797988D8047FE990C03C77EA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8e223e26466c275566a76e3a399ce1785ceb0248dfab8467fd0fa0898ee0f7ef
MD5 6402cec5ff3ecbe217c842dbf2863366
SHA1 1d5a78d5b20febb826c4e6794ba1ca660ba99195
SHA512 ee0b351cd6f182fc48dca949241493d5968690bc2277682bd6ec57a51e62f1c3e0fce17c85de00c1483850c969f51e1d5d125a294939ba273e94c105dfc3a54a
SSDEEP 96:K4POKs0KVLet5jp9bmtgqUBbKMiUHbALT4VysgKVambEXYkmue2suJ9ek2K2Teqf:I1TK7bEXYkmueVuJkk0Teq58EBaU
TLSH
T1ADB1CFD2B036824079BE290991B5C627CBC5F0B3745DA4AB3BE810764B67F425EFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c91fe1a78dc18eeef60fba0642c078593e3cbd1c2a2c49e68c1de78cbe19c36a
MD5 d94b3b7386e1f1ea3642861b9ea99aa0
SHA1 82cfecf504fd1d8b153fecc5ff223a26cabb198b
SHA512 d2e3bc0b6694aa1fbed017c9a9fd70cfb7342f9a52eef1997173e7b0f3cd793c0d6a287b37051b3f09701107d5f3668f5a777232d5d77f4d4911fdfa63653692
SSDEEP 768:5rv+4UNbdQ3IKq5CAam6aQMGdjWca4Ghf9Ar+:5bsbm3wsmaME6pA6
TLSH
T19EF2AE31A868D9739CB79295F22B7A43BEB05263C9C84E84D5DD5B0D439B4CE230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 dac205737bf2d3b19bb92b9d3abf9f5b5474dfa2c746e32d23d2f3ec4ecc77c4
MD5 9e26b3a33e3f5592ce9313881282a18e
SHA1 917ff2f6eeffdb3bc82326a582ee2d8ea49e4b4e
SHA512 212060ba32585facc616af037a1456202654b46837c246b57c5c4d4071f9ec282477de8a72c2cacb0ce22787912be3071d02b6651d85cc9d7ddeeecd2e4c4403
SSDEEP 768:irv+4UNbdQ32Kq5CAam6aQMGdjWca4Ghf9A1N:ibsbm3KsmaME6pAr
TLSH
T19B03BE31A868D9739CA79295F22B3643BEB452A3C9C84E84D5DD5B0D079B4CE330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 bdce1ee58bff46cd8ca8386d587184bf327881fb09a60f08e9e3e7eeeff6e7c9
MD5 462ec363460eacde4f4bec50c9009674
SHA1 6da4d41833a5650454faf70bd4dad017da3f6a63
SHA512 b8f150e20236db6ba9470d13bc9a5ff174a1e712de5a983daf7f1aeaaeb9524747cd3df45778da82448ce84006505d9ef1611a76bdf5ba796a60402d7f11117a
SSDEEP 768:5rv+4UNbdS32Kq1Aam6aQMGdjWca4Ghf9A1N:5bsbY3MmaME6pAr
TLSH
T1FE03BE31A86CD9339CA79196F22B7643BEB05263C9C84E84D5DD5B0D029B4CE330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 766462ff50c24020d7b2b60b131d49085d45a1bd2e2439bc104c35be05d26fb8
MD5 88f6f18a520ac4abc14bd5fbfeea7822
SHA1 66f154faf55e3e47dc4b829690942361491d897c
SHA512 1402dfc4a552652865c63998ed657c1d4a67a9062f16b2990393ede6b0eb7483b82f21875cd702b213c8b4065edada7125cc07e1008a453b4e91fa73ee8f3369
SSDEEP 768:/rv+4UNbdq3dyqtAAam6aQMGdjWca4GhfBGPeU/:/bsbc3/KmaME6p+H
TLSH
T1D6F2BF31A8689973DDB79A89F21B6B87BEF411A385D40E80C9D95B0D43970CE3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d9cc9c0-d6cc-4652-a87e-23f7ae41d0db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d9cc9c0-d6cc-4652-a87e-23f7ae41d0db.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download