hxxps://poolim[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://poolim.com
Sample260708-mpgdcset8y

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5252	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279807133808548"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{EF19F425-0327-4E59-A2C9-2F676F513456}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 3032	5764	msedge.exe	88
PID 5764 wrote to memory of 5252	5764	msedge.exe	89
PID 5764 wrote to memory of 5504	5764	msedge.exe	90
PID 5764 wrote to memory of 5504	5764	msedge.exe	90
PID 5764 wrote to memory of 5504	5764	msedge.exe	90
PID 5764 wrote to memory of 2464	5764	msedge.exe	91
PID 5764 wrote to memory of 2464	5764	msedge.exe	91
PID 5764 wrote to memory of 3496	5764	msedge.exe	93
PID 5764 wrote to memory of 5376	5764	msedge.exe	94
PID 5764 wrote to memory of 3496	5764	msedge.exe	93
PID 5764 wrote to memory of 3496	5764	msedge.exe	93
PID 5764 wrote to memory of 5376	5764	msedge.exe	94
PID 5764 wrote to memory of 5376	5764	msedge.exe	94
PID 5764 wrote to memory of 3368	5764	msedge.exe	95
PID 5764 wrote to memory of 3368	5764	msedge.exe	95
PID 5764 wrote to memory of 3368	5764	msedge.exe	95
PID 5764 wrote to memory of 4688	5764	msedge.exe	96
PID 5764 wrote to memory of 4688	5764	msedge.exe	96
PID 5764 wrote to memory of 4688	5764	msedge.exe	96
PID 5764 wrote to memory of 1820	5764	msedge.exe	98
PID 5764 wrote to memory of 1820	5764	msedge.exe	98
PID 5764 wrote to memory of 5676	5764	msedge.exe	99
PID 5764 wrote to memory of 5676	5764	msedge.exe	99
PID 5764 wrote to memory of 4280	5764	msedge.exe	101
PID 5764 wrote to memory of 4904	5764	msedge.exe	104
PID 5764 wrote to memory of 4904	5764	msedge.exe	104
PID 5764 wrote to memory of 3532	5764	msedge.exe	106
PID 5764 wrote to memory of 3772	5764	msedge.exe	107
PID 5764 wrote to memory of 5240	5764	msedge.exe	108
PID 5764 wrote to memory of 3076	5764	msedge.exe	109
PID 5764 wrote to memory of 3076	5764	msedge.exe	109
PID 5764 wrote to memory of 3324	5764	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://poolim.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff9a423c188,0x7ff9a423c194,0x7ff9a423c1a0
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14308398710042274788,9493220366630377046,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,18369139997335047116,16777281864243046301,262144 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,15468267414921840679,1545049177788434412,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,11058158837369784785,7785496468768140275,2097152 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,12427407274079957160,9865019216514710661,2097152 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,17596275043949381004,16813251131888068954,2097152 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:9
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,693043792291307051,16092499141010297439,2097152 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,10820039025320000325,5301953045013227092,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,13900401905875556215,11417953439294488840,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,12519162541339932472,14866142661452060453,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,12519162541339932472,14866142661452060453,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,12538872141250674563,8870683156183617849,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:12
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,10752084815745066956,10638517308285396811,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,17788623450993840792,6701599004112871768,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,9831260306166456039,15655627887910438885,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,6164049151224125011,621932207480015333,524288 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5640,i,13044028800997097144,3493764976790136329,262144 --field-trial-handle=2576,i,1875624808980968069,4790344995058232243,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5373dba236158f8b47a5d7b664d171a8c47fe1fccd7b9ce0e1bd4afa2951d836
MD5 94a2023674c565156f1a36186c104810
SHA1 86e289a50e37125a5f15b949883b1e7188e31934
SHA512 d74a13f710bdf2137189f88217902762a3207a2efa776e19c74d44824ac997d398c4d0995f1b45894fe98d29700bf2a4ab26ab89b59bd32b83e714bdb7d03691
TLSH
T115D09B747661D508DB40267265E55767F2115D35681D010C4041F16948557D106574BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fff4f5462f00db2197bad3d5dba44e0ed82332400e95ccd8e5aacbd03ea21ee9
MD5 5de064ddd4c36dfd1714ea6c60646443
SHA1 48976457417008f63c629290b82b7fcabfe4a7d6
SHA512 7cceae45d0afd44ac6288bfcc0bb9265585ec202aeed97194d26f5a717e32b99e16c516c465e3a99e12146fb39abc1e5707717e4ab27a4263928a6eadc9da500
TLSH
T1D6D09B747671D508DB40267265E55767F2015D35541D010C4041F17948557D106574AB
MD5 SHA1 SHA512 TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000028
Size 1024KB
SHA256 9695f0405d385a4ef43b39428f5e0c293213535bf745952b36641743baf697eb
MD5 98b953fbb6051b0897d4bc2e51cf305f
SHA1 40e4fb20fe946619212573d9cda85e4052adacd9
SHA512 4ca22e14f6d15dc65a9bbbdd8293c123dcdb989ad31a50f4c008def1517f481494b6206f2aef0d4357e2aadf2181de530f8624ac02fcd146a58d1a60ca3dadd4
SSDEEP 24576:MyhXquZrUmOf8mhD/eQX1B7hUcwf6la9WHg+IF8h:3AKMhD/eALuj6la9L+h
TLSH
T12A25336A3467F6349C88D4A84F87D41AC08FA1D7D81E9139B383B9D767BC38463A0676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000029
Size 1024KB
SHA256 4d32ec63a966c5c4ea78609cf9c9fbccd9078e21130e85e072a88764c20ee304
MD5 d8132783eb7fd6f1d8f359484eba3fae
SHA1 bf89713561b34f974a114fa41037b5215587e5d3
SHA512 3ea702839f434bde326af60c2bbc3d169917c70a447453dad3ef685b038014ee7e3f7cbb994be78f7f44c59571bf8a65eca60a195a0e6012f527887c4f40d00c
SSDEEP 24576:KK0NAdpko+s8Iod33xjV/+qRFvTMSO5p9LWy3yeMrnwGgFJkQ5:KK8Avt8Z3x0iMPhr3g6aQ5
TLSH
T1082533897C1BDDC8F585EB3B43467138A96A6903BCA2E5EC01321D2479B07F5C2DE7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002c
Size 1024KB
SHA256 a11b01d9e2f22662cba83bf7af3187dffff13e6931e9b463e79c08b834b0d516
MD5 c34707f009d8d7efa3e568400bc4f132
SHA1 42a7bef68fac5affaaf6ff104df22607b346c6ed
SHA512 6f6e77fbea1de8e8b1d4a36aab8eb1e0d949086bff19aecd8ff7532660154ad75314bace6ceacccfde354b05c602737350d6d344c87679e3a18468b045b8d6e5
SSDEEP 24576:zfcKcQp2CgwJikB+W+N1u8deFWMaecCXA1zFxUHFgAZuF:jcKcQp1FT+/ZlVeBQHeHZZuF
TLSH
T1FE25338D00F9E962B3CB8013571F2279E6DE8AEB879FD5E45276ED7054004BF4A720AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000030
Size 1024KB
SHA256 acc66e6337d43bda08bd6e4943d4a9c7c0178e9727f764541ab19faddab260ed
MD5 d071900ef6bdf5b822e93b84d8926457
SHA1 c0361977bc4ded446652dce578f8e1a23d5f1a8a
SHA512 c27e80b381012a003ed63fef7e6b7a1a92954727f27004aa86bd187e0fc997b95d549dde82a8127e1df4a8320803e808298c1c96c0a49d884535ced36287cd1f
SSDEEP 24576:K6EcObvJV3NGbl5yfgEyciTTL78VhoGOA0yqHUSAiuKba7AQS:K6qvJb2lgCcgj8V+fAJqHUSAY2cQS
TLSH
T14F25335A0F7072516297BD212360D09F58EF3FA6D9AFF7F5E133200A84AF40574A968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 5c52c793a154bddb775fc0cc66249c60b6087ac84bf7c7e8007f2575f4418915
MD5 98a6edbefd896e7a168b10a810ab97b2
SHA1 6552ddb7a816304f691d8665079a3471da989acb
SHA512 b8cdbf67b71e3f5993e8ab04142330c5949b2f41f911fb5bdac4ce5982074694eae2e2eb2267cc1758099563b9bea9326717f79d0c71d185ed08e9b9292b80a8
TLSH
T17121AC8583ADE2C2DF5033F615D1BACAB2755899FD073B52396C30381A82F93A0A5474
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6b0f5431a229187af5a1a64ef799fd0546ffbc75ec0e32a49d179002e60768f2
MD5 231fb3e1f2840fd94b094cb26c4b7405
SHA1 53f12f190532ca7052ef3e698b7a98f87d0b1a34
SHA512 ad159192d33bc8429e7998bc635837015e1086e383325aa9c31f33a889e17dd37ca83560a1b2897c2f9e56cc1381a22981e3bd41bdd16c94aed151cd62a718c2
TLSH
T18E519BF7C3E9892D891156F4AB18AE1BCE190914432C3D6AC5E4BF4BA3E3471E241A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b44b4245db825de6a55053132718f80e62c93691a71b7be1bc6edc52202f5731
MD5 1d5e130cab4cab3e5f632241010cc4fc
SHA1 56974b9100734c90792caef40d4fc401b5294c48
SHA512 a3749338b543f31fde1d691ac0a63d0156ba4ed0ee93d6bd94380a51f49f03159afccf3ade58ebcf41e8298a8fee3b21827614a27204cc3e6b2c680e2c3351d2
SSDEEP 192:sxRS/ywF6KOMl8UQVbF/fXsxbm9Bvs3XuIzoA8p1s/g6+WNFMSdYPj7tiiGKIgDs:sxRSbqNF/fXsxb4vVO/53dUJhA
TLSH
T14262D816A524997BDCDBD209FA557F53D6F81473A2901E44AAFCCA0C01E7BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 658afff838d8d6e69eca92b465ec390c76f3a579640e1e4cd8e83bc550a2a950
MD5 a604f65ddaf763921989387c16208e7c
SHA1 ce0931e6c889368a3d5bb485c0401329701d305d
SHA512 08b5ab79079f1c7c5ba9469f9689d1b42b47ac36c23e0fb18b4e6398e1ecc2fff55f7b6e9b58624332cb85f53c232e3ee4d6f0e02937404fb9033b95b258eb2e
SSDEEP 192:sxRd/ywF6KOMl8wbF/fXsQbm94vs3XuIzoA8prs/g6+WNFbz/YPZ7tiiGKIgIJ:sxRdblF/fXsQbBvVw/5x/sJhs
TLSH
T1C552D8066624993B9CDBD209FA557F53D6F91573A2901E44AAFCCA0C01EBBED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 02abb4d4fa6cfd18c5b05627d65d58c5dfe6b5c003672043cc8e53e091c9a234
MD5 93a6d8eafb6352417aca48b35e8fded7
SHA1 e36acf8caf456496abe6c917635334a8d8e50ec0
SHA512 51edffa7729913073cf24df0e8f2a7bb74945e4890a0ef02ece7a73661d89c6561558835b86dd6b450a1186c906719bb925d5f924c711b5b6778a4a7a8cf393d
SSDEEP 192:sxRS/ywF6KOMl8wbF/fXsxbm94vs3XuIzoA8prs/g6+WNFvfVYP57tiiGKIgDDQ7:sxRSblF/fXsxbBvVw/5JV0Jhy
TLSH
T1B462D806A634997B9CDBD209FA557F53D6F91072A2901E44AAFCDA0C01E77EC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c0239eb79f9cd075749d9f4ee8ec3877d020fd39446edb62be6d406d13a7fa77
MD5 d1df9b9299e3d8c7007bacdbb95fd675
SHA1 63eb35c2cf4d24205e0c99ea3ebb0638f68f03ed
SHA512 d1796394461c2f8327571b20bc4a2ca6ce99c093e40f6ed5e065e98eced6162ba717c87c15e17a5289a8130c9b07047bc3df9ccbf2c432cb288742f3b51cde86
SSDEEP 768:+Pw4qBWg5tf+T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2Ux2KromwZc:+Pw4qBWg5tf+Tu1jarW2hK
TLSH
T199C2EB2B640CC77E4F844E9DAC29AE97ADD801CB9B984D5447FE890C03C77EB512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6572.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6572.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5aed102ca09684df3e2a44d73e172f7366ad5d7d5acfd12f2ac1589b46354a72
MD5 b478169bbde1bfe6a67904e5fff65b9a
SHA1 f0f13e7662a8843ab72a97c20fbf7d69f3cbef40
SHA512 ca4afd769828c65d763b5d52e2f2f859842ca3c434a67d50917bd25452affe1f767ad64b88427ddd8b7d4dab05ab99a7668d334a1b66efc0b90e7c3cd8b61efb
SSDEEP 768:Krv+4UNbdN3QGVYL0DOOcuyvKweY5PWu3N+pyw8MjH2:Kbsbj3Q70Dwua4e/zc2
TLSH
T1BB13CF33B8A4DA779DE7D295F257B283AFB8115382840B58C4E92E0D43978DD230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0e22911d1f7dacefbb06995726138e6a58c056b2672877b4a624628a8ab889f4
MD5 f6748cec0a8f51eb0104fcc5961b1205
SHA1 68d91f1b0f47dcb0026869cec17b540517804483
SHA512 a2240af999edcf65d38327ea7f75eec7a37483ee27492eb592b2d6b439f14ed2d79e6287af394aebad0f80ff2f77a4048c2ac9a3e115023e0018530651f365df
SSDEEP 768:Xj+9w3QVVYL0DOicuyvKweY5PWu3N+pyw8MjHn:a9w3Q00Dqua4e/zcn
TLSH
T17FF2AE32ACA19DA78DE7D2D5F6177392EFB8125382840F58C5EC6E0E06936AC1357C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d4eb936e90f5b17ffc8a47cae7b1bad57ad8e536c8e17d96e5d3d5435bac8ae5
MD5 f273636f90fe38fb7c5c6d68edae6916
SHA1 8a92eab2c87ad27936753fcd97a6feb8e7b12a17
SHA512 97d8ca53b1af88d84ecf5d3241044a803ea1d095afea2f9477096e333147eb4bced535650a2d5070e317082e6f1555c8aaa57a4f60809f129fa42c5584235b70
SSDEEP 768:dF1j+9G3QwgGIVYL0DOEcuyvKweY5PWu3N+pyw8MjHn:09G3Dh0Doua4e/zcn
TLSH
T105136BF258D3897ADC9E8787A73E2E419EBCC153B1804A14B3D8190DCE931BFD246C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 dc2108a19e0422afce11a079fd105e8c701af4aeec0ddb69dc5e3487f430ab40
MD5 bef4c0c246cd2ba4e23b7552980c5f61
SHA1 dc8fd001fddcc35ee588c72dbf7cbc32badb6bc8
SHA512 57070b8377109e04ef9037d9500e066add31120f8371568f999c97e79d90dd2beadbb7417a6a3bc9540d5a34fb9d855100f96ff7b882f6f8d46420589590e1ab
SSDEEP 768:Yrv+4UNbd43pgRYL0icuyvKweY5PWu3N+pmT0UigCI:YbsbW3pR0/ua4e/SU53
TLSH
T1BC03CF33ACA499778CE7A295F24BB693BFB81113D2840B58C1E92B0D436759D2347D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a15e29b6-6a11-423c-8c3a-b93ff38e372d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a15e29b6-6a11-423c-8c3a-b93ff38e372d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download