1fa18620f90b76ca2e87c3b9eac3f4ce7d256495e3ede245fbeafbbd14828f29

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProjetCompil/Cobertura/CouvertureVerif/ProjetCompil.Verif.Src.ErreurReglesTypage.html
Size 3KB
Sample260601-pgalysdt2q
SHA256 1fa18620f90b76ca2e87c3b9eac3f4ce7d256495e3ede245fbeafbbd14828f29
MD5 667f6a09bd9f34f0f9f4cd55083dc563
SHA1 9d5403390f137c1d3ab05dffbd944db0ebbaee8f
SHA512 fb9f2a742b0ee0b841cbbd5185e0f9a054756d97cf834feda1565d124ff1d3b3ab2204b7a9f3bcb240b7e89aa254666eb5e0134a79d83029f1290dbfebfb77a5
TLSH
T17D71676528D5B277802346DBF4AA2FE735D18469D6410C84D9FD2AEBAFCACE4A013608
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_120993198\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1040976733\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1151624075\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1151624075\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1151624075\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1151624075\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_120993198\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1040976733\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1151624075\_platform_specific\win_x64\widevinecdm.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1484	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247901000479783"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{D1C9D640-6066-407B-814C-2217E6417541}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5444	2484	msedge.exe	80
PID 2484 wrote to memory of 1484	2484	msedge.exe	81
PID 2484 wrote to memory of 3416	2484	msedge.exe	82
PID 2484 wrote to memory of 3416	2484	msedge.exe	82
PID 2484 wrote to memory of 3416	2484	msedge.exe	82
PID 2484 wrote to memory of 1500	2484	msedge.exe	84
PID 2484 wrote to memory of 1500	2484	msedge.exe	84
PID 2484 wrote to memory of 4160	2484	msedge.exe	85
PID 2484 wrote to memory of 4160	2484	msedge.exe	85
PID 2484 wrote to memory of 4160	2484	msedge.exe	85
PID 2484 wrote to memory of 4508	2484	msedge.exe	86
PID 2484 wrote to memory of 4508	2484	msedge.exe	86
PID 2484 wrote to memory of 4508	2484	msedge.exe	86
PID 2484 wrote to memory of 3280	2484	msedge.exe	88
PID 2484 wrote to memory of 2504	2484	msedge.exe	89
PID 2484 wrote to memory of 3280	2484	msedge.exe	88
PID 2484 wrote to memory of 2504	2484	msedge.exe	89
PID 2484 wrote to memory of 4980	2484	msedge.exe	91
PID 2484 wrote to memory of 5660	2484	msedge.exe	92
PID 4980 wrote to memory of 2076	4980	msedge.exe	93
PID 2484 wrote to memory of 2588	2484	msedge.exe	96
PID 2484 wrote to memory of 4672	2484	msedge.exe	97
PID 2484 wrote to memory of 2692	2484	msedge.exe	98
PID 2484 wrote to memory of 4320	2484	msedge.exe	99
PID 2484 wrote to memory of 4320	2484	msedge.exe	99
PID 2484 wrote to memory of 5000	2484	msedge.exe	102
PID 2484 wrote to memory of 5000	2484	msedge.exe	102
PID 2484 wrote to memory of 2108	2484	msedge.exe	103
PID 2484 wrote to memory of 2108	2484	msedge.exe	103
PID 2484 wrote to memory of 1232	2484	msedge.exe	104
PID 2484 wrote to memory of 3896	2484	msedge.exe	105
PID 2484 wrote to memory of 3896	2484	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ProjetCompil\Cobertura\CouvertureVerif\ProjetCompil.Verif.Src.ErreurReglesTypage.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbc177c188,0x7ffbc177c194,0x7ffbc177c1a0
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,3043815086327023005,1342367853609932282,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,11812980567475070990,287434205475974939,262144 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,790411782989688583,11628703979272879368,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,304077244928800062,3111507438632900231,2097152 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6066979560477908915,969461105839983497,2097152 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13874381021220836989,2099307399394693472,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1865933519867371967,5585567363356825172,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,8098253834769828762,50097622682722578,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,11977170202477100922,16171718546370660547,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,8098253834769828762,50097622682722578,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7560918631116169897,1199670956604496624,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,1793189350586584799,12470395122277494356,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,14623504834786257187,6270376672216091947,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,13728045356706005720,12011292885107964494,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,542158355999679610,8487660895925763432,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,16096930993661706401,4267445096660036549,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,15418188019223613261,10637347235179679619,262144 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,16966468285100358329,3913399262141392429,524288 --field-trial-handle=2232,i,16447946284818418609,1659937709214674412,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

759584f7-8bbc-41f1-ad8e-ed986a7922b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\759584f7-8bbc-41f1-ad8e-ed986a7922b9.tmp
Size 28KB
SHA256 d29803b49b1c110ff0bbb68da3f5a89666adc6e41e4ada72a49a4b241b00c169
MD5 c91c9efaaea31baa470cdb89741072bf
SHA1 5737a7faeab015f33cdffb2eed422a1dd39ec245
SHA512 82b414fe4d14ce3e027eb9c76f30c42bfd08ef7d9585a1202e477c81019000380b53144a3a6a87ef00a83b9f868103d86274b95788b91faea53ac4fffaef945d
SSDEEP 768:9FnejZbL3rwgKmnJoCG1lDMLG+SoVXzjCj:a33Qb1lQLG+SQzmj
TLSH
T1EDD25D32E864DAB7EDE79E99B70A7A03EFE5019785CC5AD4DAC91D0D00C729D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4eb52e4bb8ac6c9b7ad3b78ab9f7b12a629333d4a313570e3ae7da0dd7bf12cd
MD5 d9b2b93cd0888829b72f431c02cea980
SHA1 fd750b7496947f84586b1adac50d1982cb9c9bec
SHA512 214121787556844d78c64d4c761143f87a0aa8809ed112d5c4a24e129eb4269fe67decb2928f4c40a39ed7fba829a5717674adbbc687d1649443f139d47d60f4
TLSH
T182F0F9BAC920AC3714FD0B1D70A90B4AFB51135B2780995B3B3D420D4FB163B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 91aa5372296ee9bc504c3559225c14587871c3968ff6e3f12625b590447b4c3f
MD5 eeba55e09e3c942722592837e75a0769
SHA1 fbe61223c163ab0eaf13190bd0ff1a3b5a8b924f
SHA512 3ac410f909d743a2f2de877883bfd673d61c9f1e91464a14b0db36480a6398e1ccca03fadd88c46ec007f8dcbcf36a432fb7f8574b2d39136b745d6b5c86a78f
TLSH
T1C7419EF7C3E8856DCA1195F0BA287E2BCE2D0954432C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8a3ac55c79e49cd42e95931008ca01804258af6a3599d3e01808335c4d930b3b
MD5 a7a524520e02804e54044436a4752374
SHA1 7d6fe78a5f1f000255667047c24bdacd794c9204
SHA512 adc464ad4749037d538ba9747c20814d92d79b86e507b42bc9483c122e6e92034298b9ba8ab05839fb630a4d68e4d0e59d131521bcc156f37c94f623b647b240
SSDEEP 192:sxZSRTiyMqZjK1Ml8MFs/fWs8PGxE0CXUyynDzzodpED4/W6+WNGY0dgTITIgj3J:sxZSrds/fWs8PG60Ly8oQ4/bG5gyjZ
TLSH
T1F762F9166A3899778CDBD319FA457F53D3F9152392405E44AAFCCB0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3c6489940f32aca8712cfd30d2c21742c633d08d8ed4b3e966ada4c395926fac
MD5 acf4da9339c6ba437931e8c1c0d006ab
SHA1 f6d326118d6a1a5b5e68ec65d9c6567816f4b83c
SHA512 fcc71e8c689b0657d700becfed956465aab8e4d8c8b6349ea59f315dbc1b19eaae1ed658675e878374c0bf9f2c943e4d47954dbfae2a1c46785e23ac4da8eb01
SSDEEP 192:sxZSRTiyMqZjK1Ml8UQGFs/fWs3mE0CXUyynDzzodpED4/W6+WNGY0d4TITIg53P:sxZSrqUs/fWs3p0Ly8oQ4/bG5Ay3F
TLSH
T13372F816AA3899778CDBD219FA45BF53D3F9156391404E44AAFCCF0C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 bbdd43029f7b8330d9a504f898621fa404f2cc99cae3cd82275efc34e5a40548
MD5 c7825e296050ba1144cec5216c8d418f
SHA1 c9aeef613c0498b1752b84596859e6f118e74f52
SHA512 1a738a81d572c62b39e507b175774eaad10f133a4c47dc9031875096583a3f86cb26968bf07cfb21328394de8a766754826edba93888cac9e0095ebe113bc136
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV333pQLll:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK33pK
TLSH
T1BB031B3B680CCB7E4F804E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B0DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4d0d25f6eeef44db94c16e510af248969667d373eaeff4a112e9cdfa3a87902d
MD5 df9f25f95cbd5def1840f757b89ee755
SHA1 21af9d2a9222246a4b4c4a86048aab49cfd6dc68
SHA512 713b9db220cc7fe49e15c6dc1b5a6fe817206648ba07e5480ccb74d2fcdb30768f183577616f6ea09d2e0a870ce4469c5656a64eb96538b5be6829950eb43ec8
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7edY:AFBHhTofhno2mB21q3Llbfe3sLDdeEpp
TLSH
T142B27C56717B12023C3E290CE6919B770E8272A3355CA56F7BB800BA4E67E615DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3fdc776-03a4-423c-a1a8-47c87986b716.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3fdc776-03a4-423c-a1a8-47c87986b716.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 51e46f976d61b115d5958f0086c2a43373aa55e8861aab5c4a52cfd1c708b538
MD5 5d04fa0cb39792ee87955f4b34e2cbca
SHA1 32e4003c6faa5a028997cf55fcc5356632fb67a8
SHA512 60e711492229a64b2dc3695a7de86b8d790aacc6182d34b867e1e729bd5f4ac5a99ff9e038b9826a19a04be39eb2ce80bdee207722898a86f2603ba2af83c21f
SSDEEP 768:5FnejZbD3rwgKmnJoCG1l4MLG+SoVXzjCj:Ov3Qb1l7LG+SQzmj
TLSH
T10AD25D32E868DAB7EDE79E99B70A7A03EFE5019785CC5AD4DAC91D0D00C729D1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 beacea090d94994cb0db1fd96e15db753c8305cdf7ad53fbf77a5f13f762aa6a
MD5 52e78ebed82247dc83d18a58edd86ee4
SHA1 26df97ecd476da0c54af6a4f8f3c0cb00a308d24
SHA512 1f99d0ab63a85898645768df8b5b4d05ad9128ce43348e86021e583e4d080d46014d8f3f455357d64c141ddfb7cff47ea8c513113fda7978de9fe73be0d375a4
SSDEEP 384:n5FiF9CcmyWCs38NI8TUNTUlIxBydvOoaajkpfb7oBUG1lWeAMphkP+lFYS/F+H0:OFccps3bwgDF7JoCG1laMphkoFYS/j
TLSH
T148C25B32EC98C9B7ECEA4FD9F74A7A02EEE0016385885AD4DAC81D1D00DB1DD5707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1005b3d4bf951b1f246786c9307c21c2cc5307bfd2292c69981eab8d090872de
MD5 18764332e9a7295e0ba318b65ec2843f
SHA1 c3021b8a0886c71e51a7f06913924c5e59fe1f96
SHA512 96ac397156b68a583584ef5576c8b8f75c907eb2e0c99c46e0350269560b4f75793e080c71f791d26b710d746eca799cde8ca7fdb4d2526586e1a0e01097b1ca
SSDEEP 768:UF1jZbr3rwgZmnJoCG1lDMLG+SoVXzjCj:gv37b1lQLG+SQzmj
TLSH
T199D25C32E864DAB7EDE79E99B70A7A03EFE5019785CC5AD4DAC91D0D00C729D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 788c96c5bd6ae1416044fadfffec070e063c806af8f10405d9b60d5f847feb3c
MD5 20c7b5a3d51527431495241d7bad39f9
SHA1 6d78e34002fd7d847317f02fb0de33771593fe0e
SHA512 ae443a6d8bc8358dc6c7e770eb5a8622c9893d88e709ce2ab21640f89ebb2934a48ffb004bdd55248794b35ab019ffd15f3e2ea2549163e833efff6d6c978004
SSDEEP 768:MFnejZbL3rwgKmnJoCG1lDMLG+SoVXzjCj:X33Qb1lQLG+SQzmj
TLSH
T1CCD25D32E864DAB7EDE79E99B70A7A03EFE5019785CC5AD4DAC91D0D00C729D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 37b279988e709513dbb1f8d97b0f065aa3bbde77a94af0b03fd3f17a063d8898
MD5 c8dd10d7b8ecfeed17656edba5e3ed7a
SHA1 fe806194136710961a3c628754ceb9371d4f414f
SHA512 c8c490c8e81897a4dee1719068ac0a0d4a2b8bea310f281d6a45c2afc273c4a1a953f84bfc7b3ce7f252dd6970ba2ff26295086c4a7626fc093a3654ca394892
TLSH
T179514EE15C7C2AC1D0BE0E6EA48B38FC82ECC725F4A434396818EA89097921D708183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 02b76f5865e15e651e974de60f01ef0d1763f9898d9e20006ecc61b4d0875814
MD5 1d511448e6147793b4b7896647f7173b
SHA1 a3217addf9b2e59a4b1aeb03069c85e3635bf2d1
SHA512 4e7536467bf47b1d4a937ba86954fb971e711e32bf0f6b57017486d1cc07962a0a8977d677fe1320a1366be87b110729638cfda160b4e3706828af180a337ad2
TLSH
T1E0514FE14C7D2AC0E0BE1A6E648B38FC81ECC725F8A430796844EAC9197961D758487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 460dafcbb36528034989a0742ff3509f6bc447c283c2edabd159ae890a27d0ef
MD5 d16851523abd46041dd66d2854b9272f
SHA1 93f8a78f4df0c46cd4859f78e24e47206fef78e4
SHA512 fe4ea589956b1476fe9acb3b22bdc714910e99baaedc5b6610f4fc2e066669a9b4bdfa0519b2546e6ae17adc7788c438c3b2eafad671c9914f4b9fc01943dc48
TLSH
T1665152E14C7C1AC1D0BE1A6E648738FC81ECC725F4A434796814EEC9097961D708183F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1040976733\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1151624075\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_120993198\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_120993198\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5660-167-0x000001A18BD90000-0x000001A18CD90000-memory.dmp

Download