91b9148d077e4f38e4e4655d8c6c1cc61a10097791ba454627a8caac3c764919

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
w3Zpjdoc10.html
Size 45KB
Sample260517-3vs74shw6n
SHA256 91b9148d077e4f38e4e4655d8c6c1cc61a10097791ba454627a8caac3c764919
MD5 567f3d1e54254a9eeb439c13742e1454
SHA1 2174cbe169a815ae27f492bf3c32f289b1992ca6
SHA512 11ab16aa813ceb3979e075d6c446152ee554120972dbd1deb284979ef53e0c209b8a4d41601f1c0559fc1bdd1f5fa7ea96588cc28d9c8e6a2719886192c1e6d7
SSDEEP 384:LThOKMvY3/WCXk5W1LH/hGhtxqjtwce6H8zBrKkpVkgzep:LThOJv8FX31LfhGhtQuPrKOCp
TLSH
T13423D785B401F97A9C63CDDE267CEF72844AF13ACB7CDC18C28FC55E1291A72671684A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1016969012\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1016969012\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1016969012\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1016969012\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1407642289\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1016969012\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1407642289\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1165617023\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1165617023\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4040	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237162031086722"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{0A99B803-D286-42FE-A2E7-B70C0196A82C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1840	2072	msedge.exe	80
PID 2072 wrote to memory of 4040	2072	msedge.exe	81
PID 2072 wrote to memory of 4716	2072	msedge.exe	82
PID 2072 wrote to memory of 4716	2072	msedge.exe	82
PID 2072 wrote to memory of 4716	2072	msedge.exe	82
PID 2072 wrote to memory of 5172	2072	msedge.exe	83
PID 2072 wrote to memory of 5172	2072	msedge.exe	83
PID 2072 wrote to memory of 6112	2072	msedge.exe	85
PID 2072 wrote to memory of 6112	2072	msedge.exe	85
PID 2072 wrote to memory of 6112	2072	msedge.exe	85
PID 2072 wrote to memory of 5664	2072	msedge.exe	86
PID 2072 wrote to memory of 5664	2072	msedge.exe	86
PID 2072 wrote to memory of 5664	2072	msedge.exe	86
PID 2072 wrote to memory of 444	2072	msedge.exe	88
PID 2072 wrote to memory of 1036	2072	msedge.exe	89
PID 2072 wrote to memory of 444	2072	msedge.exe	88
PID 2072 wrote to memory of 1036	2072	msedge.exe	89
PID 2072 wrote to memory of 2516	2072	msedge.exe	91
PID 2072 wrote to memory of 2952	2072	msedge.exe	92
PID 2952 wrote to memory of 5508	2952	msedge.exe	93
PID 2072 wrote to memory of 3692	2072	msedge.exe	96
PID 2072 wrote to memory of 780	2072	msedge.exe	97
PID 2072 wrote to memory of 3308	2072	msedge.exe	98
PID 2072 wrote to memory of 2020	2072	msedge.exe	99
PID 2072 wrote to memory of 2020	2072	msedge.exe	99
PID 2072 wrote to memory of 2616	2072	msedge.exe	102
PID 2072 wrote to memory of 2616	2072	msedge.exe	102
PID 2072 wrote to memory of 4448	2072	msedge.exe	103
PID 2072 wrote to memory of 4448	2072	msedge.exe	103
PID 2072 wrote to memory of 2132	2072	msedge.exe	104
PID 2072 wrote to memory of 4224	2072	msedge.exe	105
PID 2072 wrote to memory of 4224	2072	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\w3Zpjdoc10.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc154fc188,0x7ffc154fc194,0x7ffc154fc1a0
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1524,i,14950753127491172761,18042924743044259154,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,9591229376624534440,5801878505859597890,262144 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,1557990365285881904,5619505541424055699,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6978060802386560840,3160514484188747259,2097152 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14121719127667319092,2309375783649968603,2097152 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,14466242118521500412,4482844421464008190,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,8774949155870098788,9986698774878446097,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,10415803121485577280,7594486951718114438,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,10415803121485577280,7594486951718114438,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,10128048825530409074,11624640696869418392,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,4733840875334538134,6092992888519392221,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4429078627612904185,497197167002476860,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,8340504502269802006,3692302431387524989,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,5856273010731051336,2181258988422164734,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,11366737436248904833,8010833582203352836,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,5619692586103644317,16253122496302065404,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5424,i,7771021247947825026,9481978551309790614,262144 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,3096608862407218162,5734689644804602862,524288 --field-trial-handle=2020,i,2477080624110814793,216629753131844671,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a5272c30f7526ed719d1c23fbbf2a664ce200da98fc69918ab7f8ba4f20903
MD5 6aa2adb89bcc3973e622b85ad58e38ba
SHA1 020c781359a16ce1fa10f7a593ad7c6340efdaa6
SHA512 4cf00a3ebf14f3e625dac910de1d979319d596fc2722ecd93a3f31abf0bfd41f91e9a194434fa57d1628921a8c4084484706fb480c5d18522aceabb9b28a19e8
TLSH
T134E02BF6C8229C2B08FE072979941745D70113672B40591F373D820CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 99f3a7e83856f15ed68fdb721f36c9a9b55877af4c24cfd15ba4db703f6a574c
MD5 a3c61ef4cef3b6e1069b849573c7edd8
SHA1 6c2ff00d564619a1547404ebbbd4162d3a384ff8
SHA512 81c2d4d08b11a533746181a5f5fb09dbffcedbd0b9fd0c74b15b2c58da77643c6fc4d9df60166abafbaf20cd344c7ebe310aad93e564bae4eab5ed78ea05045b
TLSH
T14641D3F783F4866E8A0195F0AA18BE2FCE1D0515432C3D9AC5E4AF1793E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 321a6b54c223a861ec4434f94b793c556f98c70f98c50ccfac332fcf9518e70f
MD5 df7fddab5d2f0af663e968d3cfa253d6
SHA1 5ee86f5c6ce728a7645754229a7d184e3b36f509
SHA512 7d74a072792a9a0f5cf5c387e19c6a340373c8d51033fff4afa98841d53892ca2bf53ff7133ee9c27bb7b5ce72624b382f49fb192e563e275fee9826bd1c93e7
SSDEEP 192:sxZKRzyMqZjK1Ml8MF9/f8shjOKQ7PgYsp0DzodpEtY/W6+WNGY0ZkSF4pIgjJLJ:sxZKsd9/f8shiV7orp0YYY/bG50jJd
TLSH
T10362F81666385977CCDBD319FA457B93D7F9156392940E44AAFC8B0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c6ed73d93ada6bb0db49e3027f31182eb3d5932a85c31e07d6029155d4d4871e
MD5 50e39cf383ddd48b9eaeb155fdef1474
SHA1 37bddd02771e2f64952d66aea0be897b8981b6ca
SHA512 4b88cf2b65c6caa2115aa986b7c53824ecea8b1eac0cb5f9bf2890c3f3714c200c047860226c880b7e42e68cbf2045a7feeb5b502ac5da7ff8b0fe873a602d5a
SSDEEP 192:sxZKRzyMqZjK1Ml8UQZF9/f8sXjcKQ7PgYsp0DzodpEtY/W6+WNGY0ZgSF4pIg5C:sxZKsqf9/f8sXIV7orp0YYY/bG5ExLa
TLSH
T1DD72F81666384977CCDBD219FA457B93D7F9156392940E44AAFCCB1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 39e4f3811a720b37dd65ad621835435b69c1b01deb562ace1502065b0350b199
MD5 27e24dee4e803c2884090663ebad81d0
SHA1 3c2d2b277f952293492d594a57ce52036531856e
SHA512 6301950f885bb1565338d28a838e780445fea91e2d73fe751db9bc405d21b0bafc122d0011cdd509ac899c3b50ee61f6463bf08438638123eb7f4442d3b9f6fb
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VGq9LlQ:XwZh38Dv2SkEnZFWRm6GQFmu1jaKVGqw
TLSH
T105030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 74d22981dfcd84a9282c320b1c9f7d701e5b66cc775dff5f004f44b4ee2878b4
MD5 07e6f3ab5ba9631400eef3add7e04a6b
SHA1 82a2f518276a590f83ff99116b954b013da65f81
SHA512 0ceb99682d4e0cbb71e6f000cbdea2cde27e68cec4688a68cc4771b5bddfbd69d8ccea01e992f650de04c4d0da277b4fba86fe36f346d23600b32f67bc13d88e
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlJfHAPvv:ctGj+BCNC5qFVpKxJ/AXv
TLSH
T168C2691632FA02123C3E791D879597371A42B2A33058E93B7BE854B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 fc9d872016fcee5ab929cca80a568fcc75e5926cd680ae1a78645506cee29f94
MD5 b39258b0832d5fbf39143ab5cdb11912
SHA1 de8bc27f4830cae31a90b58dd16aad1314142767
SHA512 379ce1e0841a2c8d116d86948a1bb529f5d777b6d27ca4e00e230514191a71a68fcf7d7b2af84bcfd2bdf2d737f33f8c109730587e2a09e1caf16808c0103097
SSDEEP 768:MFMcpp3WwgZFBOo6EfnyVyy8adnlyojln:Gp3+WEfnYylWlyod
TLSH
T110F2A3F198D79977E89E4B5BA77D2D028AFCD16375884984F7940D4CCC861BFC30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 19e91a6d51c033dda86968896d19a3e6e9dd87d6d3c22c6d16b2167a0c34c47b
MD5 61d0b4158fd1047f06df7432f7dfe156
SHA1 372318ef6a92c6778c143201e766ec183922310f
SHA512 32a3349df20665f35c2ad85729f0241f94dbf88f339ad38eaaf98582a2cd4e128621251687593eb0d9880c9910c32546f03931d9b96e424f1380c18334ba6b20
SSDEEP 384:n0iF9CcmyWCs38N6h8TUNTUlIx0x9rk6oYMF1zCfbLoJ96YTnL1fnp4cYSCJe4K3:PFccps3PhwgqxSsMzOo6Efn4SiI8p0V
TLSH
T1EEC26C36ECA9DAB7ECE74F99E74E7603DEE01263858C9AD4CAD81D0D009719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5e801ff0dc306b63b4068c5494d62b229206dc7f882b58b87eb3c2773303d099
MD5 a292019e457ee757bd781cb7207a47dd
SHA1 14bf7925ede011b5208a2689ff6fffb9077b5c90
SHA512 d4e2436f12b399a9323be9c9160a99a05529e69641607e66639bab8bf0fb765813d9464546ceb267026d686a84c25ff133228dcb9c5c6919e119a40c46b8229e
SSDEEP 384:n+iF9CcmyWCZ38N58TUNTUlIR4rk689XcM1zCfbLoJ96YTnL1fnp4cKXV5tTSCzy:VFccpZ3WwgJRBOo6EfnyV3S8adnly+
TLSH
T1ABD25C72E869DAA7FCEB4F99A74E3503CEE0116395CC99D4DAD91D4C009B1DD430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3208b4862640f2ad1a6c4497caa7b345aa5753d06ed10db46439e6edb8fe7fc7
MD5 fc581940e0b386ec5f8dc102ad3af3d4
SHA1 b6f37d7580013b76e6d1b5a841fd8f5464e0805e
SHA512 7e0b639be8873b4e81b94c5744d01f3f849f6fca9959031900940be016c3eee1b0df847c8335b26c5bcc271e34ee2e885c0949cf4c142da3a527119ba22483cf
SSDEEP 768:VFMcp53WwgZoBOo6EfnyV3S8adnlyojln:p53+JEfnY3FWlyod
TLSH
T142D25C76D869DAA7FCEB4F99E74E3503DEE01163958C8AD4DAD81E4D008B1DD430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2c54f65fcb72bdb5a2217bf4b9c55807073b12fc3f3078ef0e59589339f896c0
MD5 0d84ca62a300aaaa51c8b8ef94acf031
SHA1 c9945bb1e281e51453046c779ba4b2b20214bc95
SHA512 0981a027caf5797b1d598400d4404c7cc94d3131661ba59107419b2d04de4e2adc9aa7a325eb39da8798343524d94b05d72c3cb3e3bd66023917a8e97c31d98d
SSDEEP 768:pFMcp53WwgZoBOo6EfnyV3S8adnlyojln:N53+JEfnY3FWlyod
TLSH
T132D25B76D869DAA7FCEB4F99E74E3503DEE01163958C89D4DAD81E4D008B1DD430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6d963e3246937d1dd14425e249a31873f90f5e7263d11d5d8c9c3e9a13f60f9f
MD5 a6b4f5718d59bfb586cfe7bc6fe5b2bf
SHA1 b8fb2c087aa8319d31619532608a37da3f56267c
SHA512 bc22701d58b522890b53d8aac5bc12dba17381f7d48a9bb9c3e816ed6a0ed9b8920975888748eb22d62df44c6af9ba461babeca1392ae38038095e0e6a514949
TLSH
T1C5515EE14C792AC1D4BD1A7F608B38FC85E8C725F5A434792868EA990E79A2C64C543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c9764740e2f4c33b84cda5aaaaab62ed7592c41584b9eeacbfe8221e5f3e31b
MD5 50f9f73222fe38fc2d58ffa519fdb3f5
SHA1 6a036891fa9874dc297593786e8990a442209f45
SHA512 83eb35725b04bebee4bd90ab6fb3f840a46a9a8dcc749f211b5f66b321defd5ebfddd7ab4894fbbd5a76b1123ee1cef87057c5c69d2b18f59270572547624baa
TLSH
T13E516FE04C7D6AC1D4BD0E6F60CB34FC82E8D625F5A0347D2868EA950A7962C74C583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9bf99640fdfbed02ef2f85ad399e6c25e8e60f1aaf56c7adf578fd25cb509418
MD5 59d807b808fdbaca146759ccf4a32a35
SHA1 ad88c881aba2d0fe07d4afb27144dcb98056bf13
SHA512 a3bf24e12b167c32a6e0c4cb15c8a8f011e95b634fd5c8b0360e1170fcc3036c96941aa7675a2f9548a5aa49f9a2249dbe3e79da84df04a6261504b68453895f
TLSH
T179515FE14C7D6AC1D4BD1A7EA08B34FC85E8C725F5A434792868EA990A79A2C34C543F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1016969012\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1165617023\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1407642289\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2072_1407642289\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2516-166-0x0000018DB2AE0000-0x0000018DB3AE0000-memory.dmp

Download