hxxps://wi511[.]wpmudev[.]host

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wi511.wpmudev.host
Sample260930-sshcqabd75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{DA211A99-3269-4469-B524-582E6D70B63A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2064	2476	msedge.exe	87
PID 2476 wrote to memory of 4596	2476	msedge.exe	88
PID 2476 wrote to memory of 1876	2476	msedge.exe	89
PID 2476 wrote to memory of 1876	2476	msedge.exe	89
PID 2476 wrote to memory of 1876	2476	msedge.exe	89
PID 2476 wrote to memory of 556	2476	msedge.exe	90
PID 2476 wrote to memory of 556	2476	msedge.exe	90
PID 2476 wrote to memory of 3548	2476	msedge.exe	91
PID 2476 wrote to memory of 5080	2476	msedge.exe	92
PID 2476 wrote to memory of 3548	2476	msedge.exe	91
PID 2476 wrote to memory of 3548	2476	msedge.exe	91
PID 2476 wrote to memory of 5080	2476	msedge.exe	92
PID 2476 wrote to memory of 5080	2476	msedge.exe	92
PID 2476 wrote to memory of 4712	2476	msedge.exe	93
PID 2476 wrote to memory of 1908	2476	msedge.exe	94
PID 2476 wrote to memory of 4712	2476	msedge.exe	93
PID 2476 wrote to memory of 4712	2476	msedge.exe	93
PID 2476 wrote to memory of 1908	2476	msedge.exe	94
PID 2476 wrote to memory of 1908	2476	msedge.exe	94
PID 2476 wrote to memory of 1412	2476	msedge.exe	99
PID 2476 wrote to memory of 1668	2476	msedge.exe	100
PID 2476 wrote to memory of 1412	2476	msedge.exe	99
PID 2476 wrote to memory of 1668	2476	msedge.exe	100
PID 2476 wrote to memory of 1424	2476	msedge.exe	102
PID 2476 wrote to memory of 4052	2476	msedge.exe	119
PID 2476 wrote to memory of 2948	2476	msedge.exe	120
PID 2476 wrote to memory of 5072	2476	msedge.exe	121
PID 2476 wrote to memory of 4532	2476	msedge.exe	124
PID 2476 wrote to memory of 4532	2476	msedge.exe	124
PID 2476 wrote to memory of 376	2476	msedge.exe	127
PID 2476 wrote to memory of 376	2476	msedge.exe	127
PID 2476 wrote to memory of 2300	2476	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wi511.wpmudev.host
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff91a6ac188,0x7ff91a6ac194,0x7ff91a6ac1a0
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9006211954905815928,10800585687808942865,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1044485121416681449,16440722727594553143,262144 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,1468561099310489857,15133808984263261550,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10078680976991142600,2005629526592280526,2097152 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17802514279871643306,3713243580494923794,2097152 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,1434284504225394349,8900457377424788071,2097152 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,10774369919133950986,8886745314390561915,2097152 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,10596676017310868465,2585710756301533076,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,16254961987776082578,6137680613949391552,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,9602028911599410806,17293268127045715392,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,9602028911599410806,17293268127045715392,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,3081104536366006142,3961998340965331248,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,61902347533485920,17586928179791825359,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,12172454329583237245,15631599796096497205,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,19650707922500127,12059601880913936404,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,16303757977850595764,17490817589387684423,524288 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5188,i,16525912180776112811,12487279477641491187,262144 --field-trial-handle=2168,i,18294513198710368091,9843179835852759010,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 de7c0235ead1fe8b34a3b9a8b43baf59f5e79d4644c9e09c93c6f5e61eac0c70
MD5 1bc3306b50fdb90b7694940c045f79d8
SHA1 8c47f18884647714b913f288932f50a11a9e9163
SHA512 bbcf1a5b13a0881ce7d034bd64e3a302af2bf3dd51e2bafc1639b5cec968c7f55a3ea8e9578dae7f0f25e08d900c72ae876cbdac59a5f1d6724f62d47ae5e1fe
TLSH
T190511D90BAE0C245F7B442B564CD3DB73232E55D50731F522278E5FAEF263A44A863D0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fd7f4b3d42cd1bfea9bcc814df4078c9056e75d0086182d6f88ff8aa5705c378
MD5 7b3d3fe4aa1a49ffd7942b99612387e8
SHA1 6f867fdacf7b69f2df1005d2c5cd5e67c3e932cd
SHA512 402d7e18668982a832fab92d7ff398b45de6ad2594759ac05d2385ffe5bfa555dccbea3a0d74de3a6c99b9fbe9d205ac67a940383176e5a8649bb61bad816154
TLSH
T1E4519EB7C7F581AD892116F0AA186E6BCF1D0A18425C3D49C6D4EF5F67F2871E24118F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e70be28b786c1f646042824d9d18299777210c6f46e2bff67162dc523cc4a512
MD5 4d3abce7f838ac2c8412565adca9bfb2
SHA1 0c46fb6673055a731f7cacd85cd333b321e20879
SHA512 98ad00e1310cb06ee29b96d2d1e01873a2c9d7858a2eab2ae0e3b398deced8f9ef04c36e27665b446424530458d1e0f04e5634ece45a45b61d466d6c0ffc9d4e
SSDEEP 192:sxZfRSW7/fqsfVZyIdpeWHW6+WNtjf/Ygh6F6IgrJ:sxZfX7/fqsfVZ7xHb9/G09
TLSH
T19522A7117E38A97F8CC7D60DBA15BF53E6F9503291951E88AAFC961C04E6ADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e486973a87c403b0efe66aa0ad8d9de0bcee14042b437eb661ad2162d0f43a51
MD5 d9450e20dd1481d9bea100928df1119c
SHA1 ee9b36941c982b9dc78679ee984d3cbc07418208
SHA512 0247190f32c786453d7bf59839e0ffc75bdc02cc2d20aee6cb1af8af16353bffc4a7267e9bc4910176f32106ecb8dc067b5ded96373d88aedbc0bd293e7c76b1
SSDEEP 192:sxZfRSW7/fqsu3ZyIdpEWHW6+WNtjf/YgK6F6Ig5AJ:sxZfX7/fqsu3Z7THb9/p0K
TLSH
T13832B8167E28A97B8CC7D60DFA55BF53E2F9503291911E88A6FC861C05E6BCD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a784aa764bf531c3d134e831d0689ac203cc246f85ca005d40c7dea677b7ff57
MD5 da504a3c6412151f26e0540682edfbf7
SHA1 4a6a57416183092fff95910dfcf6424c099e3dc5
SHA512 30db87e8a9e14f71733279535815e9eed0363c9f78d22a39d2d464348309d962f50b0d92f5296e8b50283d1bb7111b998933f9c71d35cba726c8b213bb64fe82
SSDEEP 192:sxZfRSW7/fqsu3ZyIdpeWHW6+WNtjf/YgE6F6Ig5AJ:sxZfX7/fqsu3Z7xHb9/j0K
TLSH
T14322B7157E28A97B8CC7D60DBB15BF53E6F9503291951E88AAFC861C05E6BCD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1bec536a2a0c355ec0ce23990dc340ed25cfd90be07636cbe05610bd7c20cc8f
MD5 a28463cb637949d37f75988039eb0bf1
SHA1 286cb3c2fa7ed31402b43be5722d0fea23960af3
SHA512 c6af0ecdb8558c3ec1ca4670605f34e520aadb519500ad64c6a3835f76c1e7ee2fb0ea5e2477cdfe7044b47c248310cf558e448e48802bea707a98fc260aad5f
SSDEEP 192:sxZfRSW7/fqsuVZyIdpeWHW6+WNtjf/Ygh6F6Ig5qJ:sxZfX7/fqsuVZ7xHb9/G0w
TLSH
T11E22A6117E28A97B8CCBD60DBB15BF53E6F9503191951E88AAFC961C04E6ADD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2cbcd3a672af9a66ab1afc784aa86809710eae93a9868cee7a6f6ee6b0821424
MD5 ac388616ee780808f263a666c1be3320
SHA1 bdfa8f7c8a720654840bd07c35833931b45a4864
SHA512 d01db0821bffc5d75d05f7555fcc48931c4a33c6a063e09e6d3d977cfb88553cdf95edec2383504fcdefa7b809fe4e6e89309de51747c6a701b7d3e2c85205ab
SSDEEP 768:sVichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzXrogHMV:sVichfPWvPZplu1jan+LKgzEqMV
TLSH
T186C2F93B640CCB7E4FC01A9DDD1A6F9B7E9802C7AA588D4047FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0a8b090f85c9b8416bc187f5511ece84df143d2d9ac11a75d22ff16edbbd0a5c
MD5 ce3c207d0aaab404d1035a93fde734a4
SHA1 e5cc6e001a31e39bc5a960896a7f36537dac306f
SHA512 f043d6566ac9711154430be720b8312cedc5e1aee1d0a15931f56e3b06bbb848e06a4b6fccae5e486fa2b7157249647e7c045903a22c4dfa46128e8cb3c3cf99
SSDEEP 96:KEIQKFW6WruKAs3bWKQMi+BiK64k6TWq4H:SThFVdX
TLSH
T160C1E141307B064638BD254C80A5872E464235B3316DF6BBFF7D48A28A6AE441DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598bcb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598bcb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 779dfd2fe31afa33eb1fc20e8251c623d511654b360a132c9c4f5d2fbc484733
MD5 6b8f0fecab832755ec5f011eee188c41
SHA1 3760cedbedf2c71a318f79962a773400ddc9bda7
SHA512 9842bfd03ca6d93eaded32016924cd90ad9d7c77863ecef8e576aeebe942d71605b6944fa599fdd7a2d38aa5b15e8e877dcfeff441c99aeaed8c766990cc8ff4
SSDEEP 384:9HiFiZcI4OzsNLc8TUNTUlIllSplc5Ra64BGYX5EDtOxlLjqtgOIwZOyfL0oo:MFQ4OBwgSplcu6iGYuDtOTLjqXsYA3
TLSH
T1D5C219F258E7987AD8AE5B47E77E2D034EBCC027B584AA50B398561CCC961BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 035cf8e6b7bc5057f11e626d9becd279fe6ea3ff0a9ec2ae60108316f23a9636
MD5 18d100c26ca158d7d4292407449b6bd3
SHA1 63e129b8bf54013f952dabd1be2c1f7f6857db44
SHA512 881e7ea20751a043c84eaee7943e4eae83fee57fc0353ff067f7616375afe8d6fc705031efb311a12bae9ec889d693264f53cce2bb40b58cde9a830eae52762a
SSDEEP 192:LJON46DphmqQmiUyx2q8wGYX59ezSCtORX/kk7wYnU6:lON4619HRwGYX5EDtOxnZU6
TLSH
T13402E735ADB87CBB8DE36E45F58B36139FA4112BAA946F84D6D81E1C01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e08e0db3bce0c1528434d919bfc1dbabe6497de865e8979b9b2457cacf94ddd1
MD5 bc0b83aedb838147387bcc38f28ddf6d
SHA1 189edc589b64c99d9efeb00df13ab23dbe389b88
SHA512 94ee95db0488b85e536a9812ca3c3637176f0f1cf97baaae0de19eacb22486339fd4f4a2de97c9ba0cdc530fabf2b0eeba0a8dd805463df8a837615b72463c56
SSDEEP 384:jZcIhsNLU8Splc5R464BGYX5EDtOxlLvqtgOIwZOyfL0oo:7hfplcE6iGYuDtOTLvqXsYA3
TLSH
T1BE827D32ACB89C7B5CE7A544F58B36035FB49027E6C4BB94E5EC6B1C01DA698130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33e3167950dc0a60701945be25f007b9890bd44f21d0a4182a8c67e35c0dd55a
MD5 db5c9f892849f63dbd0be6a45b5c9ec2
SHA1 86951e682a6335d717705d515878e89eafd8c2de
SHA512 96396e7c9ac2314f343aff1a1b08764a52319cfd02653b67fb5bbe3f033cb21581e8631b47c5e4e1f6c25f9ca5c8a1a0aeaaac2d95936d6d5708768f98483ed9
SSDEEP 192:LJON/h6Dph+qQmiUy52pwGYX59ezSCtORXlLxkIIw4q5dU6:lON/h615dpwGYX5EDtOxlLCqU6
TLSH
T182120936BCB8AC7B1DD26554F08736139FA55127EA847F94D6DC2A2C01EF69C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4bb48a2595995fd59cc0c5d85b2a87aa15d490d92a11485a2b73cc609186fda0
MD5 eb53e833b45a817d896f5a8089f6d160
SHA1 0661c410e796f9be4bfba95f92f01a59852ed365
SHA512 b9c180af0c7071da8c3be6d76de3bf134ad408983d8ae18c46a86b47671628920d2ded0dc223c2247b50a03072247c37e9fc640825fb1ec7ca21fde65d0b8620
SSDEEP 384:nZcIhsNLUlSplc5R464BGYX5EDtOxlLvqtgOIwZOyfL0oo:PhkplcE6iGYuDtOTLvqXsYA3
TLSH
T16E827D326CB89C7B5CE7A544F18B36035FB49027E6C8AF94E5EC6B1C01DA698130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a11b984c38671a81607476f7cb0776a09c6c6304fb10f990b3b38debde23fcf
MD5 2e233da3ce46bbe2cfe7fd3e6f0382cb
SHA1 bbfe5f004a7f332d760864c5fd1d5a5c6c6aed92
SHA512 50f1984efcf3fa16d13799c57c353e3e0184b9032400c62b2423cca6e45307a81fcae3b6d1b7a8a5c984c9b85bf079a8c40d8c228a9612b46f95b630298059f8
TLSH
T15241C858B7EA1149B3B76E5AABF6682E887ABC772E06D45D00110D4E0637B01CDA1B37
MD5 SHA1 SHA512 TLSH

Submit Download