0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pos2/application/core/index.html
Size 131B
Sample260905-anpl5atarc
SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
MD5 c92aa5f16d78423a983a5d7ae44428e4
SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
TLSH
T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330414188088497"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{3D0E5A18-9869-4FAA-8186-167B108B270C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2452	1856	msedge.exe	90
PID 1856 wrote to memory of 2864	1856	msedge.exe	92
PID 1856 wrote to memory of 5984	1856	msedge.exe	93
PID 1856 wrote to memory of 6116	1856	msedge.exe	94
PID 1856 wrote to memory of 5984	1856	msedge.exe	93
PID 1856 wrote to memory of 5984	1856	msedge.exe	93
PID 1856 wrote to memory of 6116	1856	msedge.exe	94
PID 1856 wrote to memory of 236	1856	msedge.exe	96
PID 1856 wrote to memory of 236	1856	msedge.exe	96
PID 1856 wrote to memory of 236	1856	msedge.exe	96
PID 1856 wrote to memory of 2512	1856	msedge.exe	95
PID 1856 wrote to memory of 2512	1856	msedge.exe	95
PID 1856 wrote to memory of 2512	1856	msedge.exe	95
PID 1856 wrote to memory of 5916	1856	msedge.exe	97
PID 1856 wrote to memory of 5916	1856	msedge.exe	97
PID 1856 wrote to memory of 5916	1856	msedge.exe	97
PID 1856 wrote to memory of 4432	1856	msedge.exe	98
PID 1856 wrote to memory of 4432	1856	msedge.exe	98
PID 1856 wrote to memory of 4432	1856	msedge.exe	98
PID 1856 wrote to memory of 436	1856	msedge.exe	100
PID 1856 wrote to memory of 2032	1856	msedge.exe	101
PID 1856 wrote to memory of 436	1856	msedge.exe	100
PID 1856 wrote to memory of 2032	1856	msedge.exe	101
PID 1856 wrote to memory of 3880	1856	msedge.exe	103
PID 1856 wrote to memory of 3016	1856	msedge.exe	107
PID 1856 wrote to memory of 4656	1856	msedge.exe	108
PID 1856 wrote to memory of 5096	1856	msedge.exe	109
PID 1856 wrote to memory of 4980	1856	msedge.exe	110
PID 1856 wrote to memory of 4980	1856	msedge.exe	110
PID 1856 wrote to memory of 3144	1856	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pos2\application\core\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe4df3c188,0x7ffe4df3c194,0x7ffe4df3c1a0
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7878557355010830969,15397145068816769966,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,17786281901131689048,6465934290073299183,262144 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,18284401253144727366,17507040878778079136,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,10886456863020840921,16260202838864591806,2097152 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,3630718244046129915,16606317188418375957,2097152 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4444,i,4244392020587731243,13563376636686341504,2097152 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4452,i,2730184637173360415,10403544549860340018,2097152 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:9
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,9660173591457751157,12859033109563986139,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,8721766478922907915,9012883174835099052,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,6330244760286096956,4699919046942666623,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,6330244760286096956,4699919046942666623,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,2259598220467566371,3895454329833110782,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,16302133110441300957,6667863390127362856,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,900669046666324016,3507626865108779952,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,3130564056688160229,3347458546477038518,524288 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,2796324413945662376,913451881271076136,262144 --field-trial-handle=2480,i,190214054756937741,2324422743990180434,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 938c180d0c1c71e41d7287a552d7df8264752903f32569946c0bc06431bdc6e4
MD5 a878fb3835d2a68a329b7fda2d0a296f
SHA1 d757fe59f9dbf95d75bffbfccc8c7b90e6df8def
SHA512 8e42dce3d187546fec2c63fa20250770cb5968dc6b6f5e13b81affcf5c919ac8abfd79bff594298ef3ad63eacc86e381bc38eeade50b9954a2d379f86b49ba3a
TLSH
T121512D1DA33514D2E3240772BDD394883FF5CC9A09075E1BA0409EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fac1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fac1.TMP
Size 2KB
SHA256 f73f53148ff7f6e563aa82694eb09048191e6088334a3ea4a24b2a27f79d142a
MD5 7356ca2620c3c297de75c05415274c54
SHA1 6b37948af13cad315238f7b3975cd898ba664afd
SHA512 e72941637ba9a4fad167aaf476361a38623a6afac25616dc842032260202c87c4cf980ae3e75b8d72a4b6d89dfa0530268d8ca48c99abdfc10212f4cc300258e
TLSH
T160511D1DA37514D6E3240772BDE394883FF5CC9A08075E1BA4419EB868C2F17ADD2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1473b71ea4f26a4109aec2b972c93ec4543cdc70d2348c2e2d6b0c58de916a9c
MD5 1b0e19a024f9e7e72be48a33897e78f7
SHA1 db4d461663ffbbb72536c5b04d5a4b984d2c36cf
SHA512 47d529dccdecc92502efe9904767e7bcdd3ecb4538c1b7f2506c5648aae5e48200c0d06032c64b69aae3fb23006a2e11b9757f35272fb00637aeb8726a848616
TLSH
T1E531C2F783F4957E8A1196F0AA14AE1FCE2D0515431C7C69C9E4AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 269047cd6285def7fc4e3b91d73d9ac4f4ad4940c556436d241e84a4f2e61f4d
MD5 15b94a14e2ae35235881663a73a22f74
SHA1 1298b2838a46815f01a9c74a108e56678f03ceb2
SHA512 6256cc75bf26228728a72086bfe6529f36a7c2e279514fd74d79eee452f1df7792687eee2f6219c626aea961f607fae962badd6b9b49a2c0702a4abbf519022f
SSDEEP 192:sxR3Rvb6f/f8snoprQ5GzoA8p4Q/g6+WNIYn8voGNGEIgDlxOJ:sxR3Z6f/f8snoqt/5ITTLpxa
TLSH
T18042B6156A28A93B9CCBE21DFB15BF53D3F9503261D15E48B6FC8A1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7344fb23995bf745ffbe4e35a856a10899e7d3846f06047f71411b312f2253e1
MD5 80a315939552b925c7d245de91cb2826
SHA1 46ebb1376f6f3552bfa5b0055c9ff4cb31e1fa6b
SHA512 b38f819708f4fcd4009351554c6140f162c8cb04d0ffad1249e2e377d7a8ca96d7660fc90edba909b11564edc3b3ceba4ead7bc1b9429ea9bd7bbca446a0f2d4
SSDEEP 192:sxR3Rvb6f/f8snGprQ5GzoA8p4Q/g6+WNIYn8U6GNGEIgDlxsJ:sxR3Z6f/f8snGqt/5ITuLpxQ
TLSH
T16932C6156A28A93B8CCBD21DFB15BF53D7F95032A1D16E48B6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 df62b72f3f8a7584542c2d2801fc55e6b19045b8a3642978d46e6c4d95f5e550
MD5 ecd78391f91b5d92f01150a617ca5387
SHA1 97de4d51b8302eac1b46c87260538c4a558df897
SHA512 40900876c897ea19a0a512ef1a411134f84bd5b79ca84c49f40bc093dbf9fc001efc906220ecdf94125fb5ac024617cc5cb0a7bbe475a4104517ec024a4141dc
SSDEEP 192:sxRoRvb6f/f8seGprQ5GzoA8p4Q/g6+WNIYn8U6GNGEIgIJ:sxRoZ6f/f8seGqt/5ITuLs
TLSH
T18532B6156A28A93B9CCBD21DFB19BF53D6F9503261D16E48B6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 765a3fec9ab19430db97ccecb9938a93705d8be45b070439e06ca9cd3b5eb1e9
MD5 ebe2efe60bdf6b5ccb76206a5a808671
SHA1 1aa617c1bcdf6429d35dca8ed3d7efad6b66f3a8
SHA512 418c1a5133d75b1fab06d0b79187caebe4433acdc6aafece2f0814ed2e15b4937cc3d35381633d7bd2164abf244c7ee5b1086b36293b49e166caad5f00d0710b
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPjrohMk:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VD
TLSH
T1ADB2DC3B604DCB7E5F800A9DDC19AFDB6D9802C79A948D4447FE990C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7bb1810a279aff68fe423ad3421f99bed29995fa88e5b20620ffe89b4f0077a3
MD5 b3904cd6c249d8703fe0e0af5608d560
SHA1 bbfaef3638bb9001e889c82ac8ffb1c182fd76df
SHA512 1ec1b4ef92f3d24958f3e428e5a2c7c10215cb648197cae2a5b8db1402ec0212e2f460accd2ad034c2fba1398eda5ebe7871ed9b1e60d527b2266f627aaf891d
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkveMoT04Ow:CoZs4q26neDsgU1gC/wgziItHU1gkeCX
TLSH
T14B916201303B1284387E751DA4A8A95F96817D63305CFAEB3BE901A14F27E566DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

92f3aa3b-0962-45b7-84bf-004468864d69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\92f3aa3b-0962-45b7-84bf-004468864d69.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 eddbeb85ee6ac1ba9a3075ecf1397bcb6accb803d4a743cadf3ce7bdcf86b7c4
MD5 06c5e79e30bd840d72f3645d3df3de6b
SHA1 4f63d5c56946f1dc840ca3573f005e9b9efa2c5b
SHA512 9dda23f9963a05c2cc17fca4e80a25241d7f49e05b0163d7e23f2161a49b5a3c7a71f823f6c77318159e5ca768f0055844f8d91360383d8bd2a2dd652e3a84ab
SSDEEP 768:brv+4UNbdG3/qrDZIO0Z/pSNzc4ReyIsPmdeVH1S5F:bbsbw3/jStc44bsOdEH1W
TLSH
T18C13BE32A8789D77ACE6A781B14B75037EF8912B82891A94C9DD5F0C0A4B1ED131FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ae34fdfa062d61a917e1c57945b8e080498e5493bb923edecac157781ba3f2b3
MD5 4aaf80ae3ea1e45f9b1620dcb0803a44
SHA1 1f738304665b85e0fafa7206d3448b87bba59b81
SHA512 223b19dfe71b15b61795c17a614f1312970b4aecaec5b4126b86930922938cccac33445cc0b516f03c77cdc25b4e65ab88b55440d17707fc788b8b0cadc992f8
SSDEEP 768:jFQI3AwgVarDZIO0Z/4mNzc4ReyIsPmdcTRhn:GI38Kmtc44bsOdcTRhn
TLSH
T129F2AE73AC64C97BACFA9B86F60A3602BEF54167C1C9AA90D6DD6E1C05471ED130BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6ddace40290603a397831bbd9ebe218faab8ab43b2fee996931eb63f2961466c
MD5 cf4c20ea6d166ca14544e470d884037c
SHA1 10906a34061a9dc394259b8d2d8d67dde71a08a7
SHA512 16d360a8bc4518bcae1eec0c0608753f79116bcbe126e178d53dfd3cccbd3784b75b76bb2bbf8206b06ec86f66d020e96bd946d5768b9c57ea581e81f37fa73a
SSDEEP 768:6rv+4UNbds35kDZIO0ZaNzc4ReyIsXZeVH1S5D:6bsbS32tc44bspEH1Y
TLSH
T18603CF32E8788977ACF66786B14B76533EF8512782C81B90C5DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1bc641e6324b41d5a2b09f646fad2f3f482ec36f9ad867cf6eeecaffa28b965b
MD5 42ea5d282f67a4655192c3f255b4a589
SHA1 06f1336e2010b2cc30dea9598ab44cf5326a7b61
SHA512 477e490877b0d1e8c971d76a20906c034ccee3789625a4bfeb16635ca4befbcf29cd0c8cd206623e79af9b823fc7cd11e56f666982a266b1aa95cacc4ac6c94a
SSDEEP 384:jZcIt38NlVm7yhCv/hJDZNfNoXOVSUURXvFAiXSFyRETRzcoXfK86sfxEZxxsIjw:7t3SarDZIO0Z/pSNzc4ReyIsPmdcTRhn
TLSH
T1FFF2BF72AC74CC77ACFAA346F6063542BEF5812782C96A90D9DD6F1C09476AD131BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4c30bda4fdfc4f84752f27542aa21fa451e4b80c01eaa3486caf2386cd341c1d
MD5 78ac9a526b32c6bdc6c6dc587c0f43f5
SHA1 7e41084d26bc303e86d0cfac8b0ce5a73b444088
SHA512 6761230aabed1d7df334514eef74e764430b56185cf9765f4ca7435c9a75cba7b8ca1ac831c1e97c42caa0f793723a1c865d0c1af7a87733901bc212a540351f
SSDEEP 768:srv+4UNbds3ThDZIO0Z/hNzc4ReyIs2mdeVH1S5D:sbsbS3mtc44bsldEH1Y
TLSH
T16203BE32E8789937ACE66785B14B75133EF4921B82851B90C8DD2F0C4A4B1DE131FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ae104e8-63d5-42e0-990d-81fefe15f444.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5ae104e8-63d5-42e0-990d-81fefe15f444.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download