e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh.html
Size 42B
Sample260517-2ntpmadv7t
SHA256 e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0
MD5 fd6866f1634d734f9daa7d1900967fa3
SHA1 983b472312cb71278da6849490e9590d080c3bc3
SHA512 69461bf87de3dbbb1ef07d2f33dc4d0c309a31a85fc91ebdc09d30af7ada57de56744d6df8d2eb3e6062afcf44396cb333394844af5a9b8ea12a9fcef88aa730
MD5 SHA1 SHA512

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1199697336\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1199697336\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_133715796\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_133715796\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1176	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237101896563920"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{4F445B3B-08D8-4C12-9F13-4385967AF709}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2760	4784	msedge.exe	80
PID 4784 wrote to memory of 3672	4784	msedge.exe	81
PID 4784 wrote to memory of 1176	4784	msedge.exe	82
PID 4784 wrote to memory of 3672	4784	msedge.exe	81
PID 4784 wrote to memory of 3672	4784	msedge.exe	81
PID 4784 wrote to memory of 1788	4784	msedge.exe	83
PID 4784 wrote to memory of 1788	4784	msedge.exe	83
PID 4784 wrote to memory of 4800	4784	msedge.exe	85
PID 4784 wrote to memory of 4800	4784	msedge.exe	85
PID 4784 wrote to memory of 5768	4784	msedge.exe	86
PID 4784 wrote to memory of 4800	4784	msedge.exe	85
PID 4784 wrote to memory of 5768	4784	msedge.exe	86
PID 4784 wrote to memory of 5768	4784	msedge.exe	86
PID 4784 wrote to memory of 5304	4784	msedge.exe	88
PID 4784 wrote to memory of 5024	4784	msedge.exe	89
PID 4784 wrote to memory of 5304	4784	msedge.exe	88
PID 4784 wrote to memory of 5024	4784	msedge.exe	89
PID 4784 wrote to memory of 4252	4784	msedge.exe	91
PID 4784 wrote to memory of 2200	4784	msedge.exe	92
PID 2200 wrote to memory of 2248	2200	msedge.exe	93
PID 4784 wrote to memory of 3212	4784	msedge.exe	96
PID 4784 wrote to memory of 2384	4784	msedge.exe	97
PID 4784 wrote to memory of 1056	4784	msedge.exe	98
PID 4784 wrote to memory of 4000	4784	msedge.exe	99
PID 4784 wrote to memory of 4000	4784	msedge.exe	99
PID 4784 wrote to memory of 3576	4784	msedge.exe	102
PID 4784 wrote to memory of 3576	4784	msedge.exe	102
PID 4784 wrote to memory of 4568	4784	msedge.exe	103
PID 4784 wrote to memory of 4568	4784	msedge.exe	103
PID 4784 wrote to memory of 1700	4784	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sh.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffccef0c188,0x7ffccef0c194,0x7ffccef0c1a0
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,2154626467916912886,17227498778056761499,262144 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,4203716587910795290,9524481453299721505,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,12264941976252163605,18389380594055096288,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,14159698854764237746,1395202444871871020,2097152 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,2500262746537781651,16976315353763500974,2097152 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,11198551297420719606,15946985977758494867,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,5661886419109476176,17870055099318730252,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,1503391945241935620,376444393101963304,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,1503391945241935620,376444393101963304,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,2140455428412643104,2991605994323502455,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,12037601513303120969,2316930796507141092,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,12750605791362040899,8932576002350972474,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15007561849971517310,9907361742915796601,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,9738821043847128817,8709044581451233021,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,18201982463021978516,12175517399065366378,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,12044232518769641679,5847382555269552387,524288 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,10714169733877224617,2568099732292173772,262144 --field-trial-handle=2168,i,6124807053854311484,1545452510331546798,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a5272c30f7526ed719d1c23fbbf2a664ce200da98fc69918ab7f8ba4f20903
MD5 6aa2adb89bcc3973e622b85ad58e38ba
SHA1 020c781359a16ce1fa10f7a593ad7c6340efdaa6
SHA512 4cf00a3ebf14f3e625dac910de1d979319d596fc2722ecd93a3f31abf0bfd41f91e9a194434fa57d1628921a8c4084484706fb480c5d18522aceabb9b28a19e8
TLSH
T134E02BF6C8229C2B08FE072979941745D70113672B40591F373D820CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e1c94726da5888ea6558417c1ba42e3a5562c3d1add2e59059409276d834b047
MD5 05560487d6bea2ddd38b3af8f35c7d76
SHA1 57b8d5ac60fdd323dc56930ceb1b39997c2db26f
SHA512 fe0eaec8687591114ac5a61364d9f5084138477b79f8648acb5a22ec45f0fc60f8b4015066b3214aca87389b8fa5b1838d853ca34d7885962eff420687e7fe6e
TLSH
T16741CFF7C3E8856E8A0196F0BA18BE2FCE1D0954432C3D5AC5E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 306081f277576a67e214cd8351f13a5525190afe041f015ed482d2a728e5daef
MD5 0b118a41bd7ca5616d324d780e60dd0f
SHA1 4874f7fc288cc4d0bf34f054a8c82bd884410444
SHA512 ac52e20ce2c84264f05e37517adee69b72f4407536c3ce2a4e76438cb6bff965c1988b4865a1ad35e8932cb42dfb5051b1bd0512eae504163058b3c8f93ec51f
SSDEEP 192:sxZDRkyMqZjK1Ml8UQzFE/fcsToKQ7PgYsT0+zodpEr/W6+WNGY0ZCN+bIg5q7Lb:sxZDlqpE/fcsToV7orT0lG/bG5aAU7Lb
TLSH
T1FF62F916A6385977CCDBD219FA457B93D7F9156391900E44AAFCCB1C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bd300b9abdd4b607d6ea3f2d4a640174b8dacc1783e7faef41c6f8aabfcf3eae
MD5 ab944d0fafb504dea27d614b7fd6045e
SHA1 9519a3d3a40bb1533f0e44d1beb88fa3f9e74c22
SHA512 eebcbb9964e634849d8c288a0c26edaae8502f456f2609b83fb950c1305049c7b7522ddece9cc15358138e06ecc435ba78209477142a29a6813c3ca69dbe4053
SSDEEP 192:sxZDRkyMqZjK1Ml8MFE/fcsm7KQ7PgYsT0+zodpEr/W6+WNGY0ZkN+bIgjJnWJ:sxZDldE/fcsm7V7orT0lG/bG5EAjJni
TLSH
T1A762E7166A3859778CDBD319FA457B93D7F9152391904E44AAFCCB1C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d3edbf217eaab7744245be6c9d1c16b85db752b4143e5f2057aff01d59fdec62
MD5 9481e770305e26c7efcd2c78fdb5e762
SHA1 7b57ebbd31d4fa24b2808a351670226cd716a3b0
SHA512 59f8600fb22dad2729fdceca34353d7f66991fce7e1a2dcfacb704cce8d7db8ae2dad11a142559649d98243f8b7d92a3282241d0437beb01664c9670fa8a2bf9
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3IGq9Llq:XwZh38Dv2SkEnZFWRm6GQFmu1jaKIGqK
TLSH
T1D2030A3B280CCB7E4F844E9CED267F8A6DE8028B56988D5447FA894C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eb49ec717e6d86ddb119d282b24128a25b97f2223da921b973e4718143c2fc1d
MD5 f7a4dfb96389276899e95dd6d4a89c8e
SHA1 a78b7d53eb65df06461d094ff0183be09e0cd556
SHA512 1176d53561d9c6f661c6493cdc641e625493a42e3d1510e682109c3fc8469fb5eeb10b51544db5ec50ab1a76ad378efa4b31f2f54ac085184741950f8d8e1ad5
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlp5tO:ctGj+BCNC5qFVpKxpPO
TLSH
T154B2551632BA02023C3E791D87A597371A42B2733418E93B7BE954B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 fda085ee335b6ba984ff4f24eed84c16632b629bde9c5b89ba5141a17a9a9a2d
MD5 c299801a96ac03ce1475bfb29b95095c
SHA1 d253aacf44c52b093871fa2939ae41b808b9d152
SHA512 40ba2e72b3ad03661bec88ce38117f1897438393c75d43358e7845d14908edbd4fdf0e45768d8b649a5621e1c038139ab7e937efd1723e2004cc38192611ac5b
SSDEEP 384:nDiF6CcmyWCo38NS8TUNTUlIRz5rk6PHY1zCfbHoMacjHXJgO2gCddblI4H+HLNI:uFRcpo3Bwgs66qoMbj3JgOnCfH+Ejjn
TLSH
T1A6F2A3F298D789B7E89E0B87A37E2D528AFCC157B5484984F7981D1CCC461BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3a578104b70b172889de2df46b31d49a5382c031ebee857afdeb3482a6ee910b
MD5 2a6d3f55dfefd17b04beec6e5c937651
SHA1 7f04e07e32b0a0c0bacfc1032bd6f54506724e88
SHA512 1094ff3a65f208e1e2a7f4f9fd9cad95e0710c54544f96c11f6b84f2e427acc9b096f5ac300968b40a2206476e79aa31d801dc3295256399e56b321003c688ae
SSDEEP 384:npiF9CcmyWCs38Nf8TUNTUlIx0Fvrk6owVVF1zCfbHoMacjXSOGe4KV8p0WMty/L:AFccps34wgqFAMVVzqoMbjXSOGI8p0S
TLSH
T172C25D32EC98C9B7ECDB4F99E74A6A03DDE05263868C9ED4DAD85D0C008719D174BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 53c69e75e73aeb3f6564154eb7437a217aa95ee8203710e038c0c986e31a44dd
MD5 acb3a073ec11d99f80ea2b01e2ee5e5b
SHA1 af78f794d59e757dcbaca951ef25582b1ecc7c1d
SHA512 664cceca18a21f99c909fa74c2a847ff824de31e7f08c609a4470d4d0be9be777734b98a1c401cd02c474aeafb07da06ef55592e4a6f0ea739e5ccf96377a96d
SSDEEP 384:n5iF9CcmyWCo38NS8TUNTUlIRn5rk6J0Y1zCfbHoMacjHXNAO2gCddblI4H+HLNI:QFccpo3BwgsD6qoMbj3NAOnCfH+Ejjn
TLSH
T1DDD24B33E8A8C9A7EDEA4F99E64E7653DEF0016785888AC8D9D85E1C008719D174FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 97c2283e042aa4e8ba59d194fba9e3326166493be1aa7d87821e296028edde64
MD5 6acdfda24d8773f45356446e699c2225
SHA1 36166e072c1345bcac41eb09446d911720e2e282
SHA512 58f54c61f9db7c957de0a13f1d5cf0eee3a916db54ff4b17451cc52d4fb5354e80fd2c26c87b079362aaf4944dd794dd842ce12fb08785f0e1ce5aa2454c56eb
SSDEEP 384:n5iF6CcmyWCv38NS8TUNTUlIRz5rk6P0Y1zCfbHoMacjHXNAO2gCddblI4H+HLNI:QFRcpv3BwgsV6qoMbj3NAOnCfH+Ejjn
TLSH
T1CDD24B33E8A8C9A7ADEA4F99E64E7653DEF0016785888EC8D9D85E1D008719D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cae80bc60d7737387f63a71df9511b0e480f5822d3443749886d220040c2d787
MD5 ab80fce1436fe869bd9f767fd85b3682
SHA1 362b8cfcc308936ff0f6a5d2bdc9b3f353d969e0
SHA512 8cc1de3a9661f6b926f6bc220911675fb329b314e43fa4679c0fa4b5197ce6b240f15b8b417b7072a4b20fb647002389a5fc14bf7cf25c3314f76e585ecfc40f
SSDEEP 384:nWiF6CcmyWCv38NS8TUNTUlIRz5rk6P0Y1zCfbHoMacjHXNAO2gCddblI4H+HLNI:9FRcpv3BwgsV6qoMbj3NAOnCfH+Ejjn
TLSH
T19FD24B33E8A8C9A7EDEA4F99E64E7653DEF0016785888EC8D9D85E1D008719D170FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2568a5d1b1e5f7663885fffbdc550ccee299744b32ad576b24c7af00c6d6c834
MD5 a4bbcc34ad453f20841d1f767aa7b3da
SHA1 37837a506a8d4ee791342da8c3fb57e0114c659c
SHA512 c94c29a518ff7c992dfbb002d1de92adc70fe72ef58af5cf687b120c31ece2eaac3f382739daad85a58bec562ddb5d19a225dbc10c732a8d5a7e03661d0be654
TLSH
T168517EE04C7D6AC0D0BD0E6F608B38FC86E8C625F5A0347D2864EA980978A2C74C483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6d963e3246937d1dd14425e249a31873f90f5e7263d11d5d8c9c3e9a13f60f9f
MD5 a6b4f5718d59bfb586cfe7bc6fe5b2bf
SHA1 b8fb2c087aa8319d31619532608a37da3f56267c
SHA512 bc22701d58b522890b53d8aac5bc12dba17381f7d48a9bb9c3e816ed6a0ed9b8920975888748eb22d62df44c6af9ba461babeca1392ae38038095e0e6a514949
TLSH
T1C5515EE14C792AC1D4BD1A7F608B38FC85E8C725F5A434792868EA990E79A2C64C543F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1199697336\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1199697336\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_133715796\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4252-166-0x000001A5C6590000-0x000001A5C7590000-memory.dmp

Download