b7abba5c3cde61c0447e706dfb3ae3458784f651f39f3aea6f67cb51f8ac65c7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm5.html
Size 316B
Sample260517-alr98sa16w
SHA256 b7abba5c3cde61c0447e706dfb3ae3458784f651f39f3aea6f67cb51f8ac65c7
MD5 0f831e3174ae8b638f29a21fa8928514
SHA1 04046c87f1be3740e02d1966e3e6f111830a8109
SHA512 f0191024776abd7a3cb940e4a7e0c7517e012a80e8db117fa969e0ca62b006d338b64f44f3d788487d1d6d93d332b5c014ff27d79ffeda7f6cd7d86e3c8ea281
TLSH
T10EE07DDE50A2A387481125503DD026C1364953EB34B742A86EC5D44391485BDDCA52C9
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3000_780262257\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3000_780262257\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3000_9574291\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3000_9574291\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3000_1191218539\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3000_1191218539\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237326017382280"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{74FB540B-55B1-481F-9722-9E93C39FF190}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 5504	3000	msedge.exe	84
PID 3000 wrote to memory of 2828	3000	msedge.exe	85
PID 3000 wrote to memory of 4936	3000	msedge.exe	86
PID 3000 wrote to memory of 2828	3000	msedge.exe	85
PID 3000 wrote to memory of 2828	3000	msedge.exe	85
PID 3000 wrote to memory of 4184	3000	msedge.exe	87
PID 3000 wrote to memory of 4184	3000	msedge.exe	87
PID 3000 wrote to memory of 1744	3000	msedge.exe	89
PID 3000 wrote to memory of 1308	3000	msedge.exe	90
PID 3000 wrote to memory of 1744	3000	msedge.exe	89
PID 3000 wrote to memory of 1744	3000	msedge.exe	89
PID 3000 wrote to memory of 1308	3000	msedge.exe	90
PID 3000 wrote to memory of 1308	3000	msedge.exe	90
PID 3000 wrote to memory of 1404	3000	msedge.exe	95
PID 3000 wrote to memory of 1404	3000	msedge.exe	95
PID 3000 wrote to memory of 864	3000	msedge.exe	96
PID 3000 wrote to memory of 864	3000	msedge.exe	96
PID 3000 wrote to memory of 3412	3000	msedge.exe	98
PID 3000 wrote to memory of 1356	3000	msedge.exe	105
PID 3000 wrote to memory of 4932	3000	msedge.exe	106
PID 3000 wrote to memory of 972	3000	msedge.exe	107
PID 3000 wrote to memory of 5232	3000	msedge.exe	111
PID 3000 wrote to memory of 5232	3000	msedge.exe	111
PID 3000 wrote to memory of 5812	3000	msedge.exe	115
PID 3000 wrote to memory of 5812	3000	msedge.exe	115
PID 3000 wrote to memory of 3720	3000	msedge.exe	116
PID 3000 wrote to memory of 3720	3000	msedge.exe	116
PID 3000 wrote to memory of 4168	3000	msedge.exe	118
PID 3000 wrote to memory of 4540	3000	msedge.exe	119
PID 3000 wrote to memory of 4540	3000	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\arm5.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbc838c188,0x7ffbc838c194,0x7ffbc838c1a0
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,15806270773423953007,16588487449436176161,262144 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,4711309963324408761,7401395745447948136,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,3383005499790226986,11720144057495910359,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3425149911649024398,10455169406865788775,2097152 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5633112205304380815,17785331277433255841,2097152 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,7552635956786376358,6082166084936959318,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,2796663195839757985,9499464591421817444,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,10469061905953121577,17977597368642259891,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,10469061905953121577,17977597368642259891,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12766086342001017827,1996713070822292610,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,2204062325053971409,1375726367466022559,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,920700856134754349,174747713776362328,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17793022474502304748,2625881284354921857,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,10727382297597520961,537932962949049998,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,14227064315260611449,15893411102447126885,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,7055603527919652494,11067609917264495514,262144 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,16189252022447726177,8034692597106848876,524288 --field-trial-handle=2352,i,2767400419435175220,5810131138088839496,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3000_1191218539\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3000_780262257\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3000_780262257\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3000_9574291\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a3a0c0c63e7ab274a64ad6a740f96b551d026bbd3d3479c01d73c2e5d297870d
MD5 d89245e78bbf723e45e4d9b58f50dddf
SHA1 a4971d0c7c0d247d54594218651e96b4e32aeb6f
SHA512 87cb215f6a9294c0dce8544f5d44b8d4e547d204db768c89bfcb46bd5b5172ad003604add451c96e63ab7dce5a7e8264674f09be36e9745d66954c193e466247
TLSH
T1EFE022B6D862FC2708FD07A8A4098746EB1013173B80896F3B3C82088FB473B45DAC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f17d3d5c6e4063e0e718a8fd1792b7504d1db251f2a81a6f694d0c3a0fec7fdf
MD5 11ed96995e8aad007aadaabf424d2439
SHA1 63ec1b566a5d3b8910438a037cde66eff60287be
SHA512 1502d533422f43c0025b5872eb8fb9f15e4a14ee39191786fd0932e8d62d098601bcd49456a153425d472fa57b05563bc05ad1a1bb1585aed7de4ab3dbb7c134
TLSH
T1B041CEF3C3E8856EC91195F0BA187E1BDE1D0911432C3D5AC5E4AF5B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 50b230716b26865261bf5067e9f55525ef57896b23f9da0c88c6a0d911191d1d
MD5 2d94670525fdfb1844a3614b9e050754
SHA1 4ce89dd5f92bda400fad430be6fb2ef56e7c67f5
SHA512 219a20d8fe6ecdae509cd49a2d9fe74eb18f8715f499bd0f589c5dc4e0af2807dc750ef31df885ef99707095aa2bf3d526cf65e1800b4f269e663c6117d2fa48
SSDEEP 192:sxZDRCyMqZjK1Ml8UQsk8/fmszsZdIaRuvNzodpHzHW6+WNGYv4+yHIg5jvJ:sxZDzq38/fmszszIKYGTHbG+sdx
TLSH
T12762F9166A3899778CD7D319FA457F53D7F90562A2904E44AAFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 df3454493d4d493a73fd0eb52f07dee010d0460c723da98ae592e766da4170f3
MD5 5437b8f033901a37996b8e12ef7c65f5
SHA1 90bf137be8cc7725f9575185dfd253ab87c71499
SHA512 2aa65cb415e81795f0ac08fa0d904908903e597d14a415f8ba7ac86fd5408541d13f2fecb2f4b57e2fd65d46af27f6edb64c8a8f6c91b03d073ffa304a5471f8
SSDEEP 192:sxZDRCyMqZjK1Ml8Mk8/fmssNfaZdIaRuvNzodpHzHW6+WNGYvIC+yHIgjUJ:sxZDzM8/fmssNfazIKYGTHbGrsjY
TLSH
T13162E9066A28997B8DD7D319FA457F53D7F90563A1904E44AAFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e2d84fb9ca1230b5d6410a5aee1f32e9360cb0ff300d2e9896cee58bd417e37f
MD5 4b0f97c119208b8f89b0a96c53f2df0b
SHA1 df50100a992a8875e5d11f517994ceb06ac29ca4
SHA512 2dd79dadbf4e681416194186faab66c8627b6de791d6e2b54cfc2a57bc203ea7c8ecc61834388ff55a808e38186111bec5130ab5b170674409753f7fb9b2f7f3
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXysy10Llw:eY8Od/HEnFhWvFvmXu1javt10Lm2NuQq
TLSH
T151F2FB3B6C0CCF7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 164968155ad930901caeb1f785744155ec92ea7a3c95f59c54d03b47ab687de7
MD5 af72cc74f8716e18d43f0fa830b795e4
SHA1 db05eb744556bfeadc0dd2ce3eb81c5a78a1d6bd
SHA512 0d96c503a639bb4c6bb966fea6f5d61e38177762dbf79bfb0da355762f2f1cc3187d55cfca28fed68f19d910685c4b70f811930ab14824e6ee950baf3471bcbe
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGW:05ppxnY753RNBvRJJdt7p5J9Vlf6
TLSH
T1BCB29C1A713F0212397E2948B39696364F4235A37058E4AF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 52458acfb012e24af6bdb0ed16631d310d96fcb6b51c5c4ff623fc4c93d143a0
MD5 997f7afc92a8feb92a3be50e469f59cb
SHA1 ade815e82aa99c54efe401a86e69acc761ec99b3
SHA512 14954224d1a3dd885273d6f243fa3f4e74eb4e7bb9a19e3106f63a51d4f052f278436b86ecfeead6f8a73cbd9fd53ba8e95a37990e45231bdcfd064b6afbf084
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlImp90QckCr9lGKphBftGnIJpae4KV8p0mHpty/7e:pEFccps3mwg490kU8k1GIeI8p0wd
TLSH
T127C25C36DC58C9BBECE74F99BB4A7A03EFE01267859899D4DAD81D0D10971DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cdda2b7ed3822d700f88f8fe80b26d889715c953ea5833a87017db620e49b703
MD5 7966da39e8528ae1e01230b5c9ba19a4
SHA1 2ad88d48e8b4c3c91a7b5ad2b4c0fae7e553d98e
SHA512 a26a19f193c6c75e08998745d7287fa10ea5b51957906e661d22683c3f76cf2c74cca1cc3ba4850db361a62e73cdcc6b250e4c6480c099d0e72c10f1b3b6be11
SSDEEP 384:ntiF9CcmyWCt3sN18TUNTUlI4olQckCr+BrphBftGnvCsplCddblI4H+HM8LUytY:kFccpt3QwgXzkFF1GvCsCfH+QjXn
TLSH
T1CCD26C36D8A8C9BBEDE74F99F74A3613EFE44167858859D8DAD81E0D00872DD030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cf67fc43d0f0778d282df201097e59cb7b0010b7022915d05145fffd13225f83
MD5 f3fa67f9104f1a544a3c27cce9fd4677
SHA1 43edfe3d8bd51019c82f2ca97e9c22d68d0ef47f
SHA512 21d414337e8a82d8054631d52e101513be11f542dac95b9d4ec0a6ca2a89fd6b0d315ae34e94cf164529cf3c2ae7eb2f623cbf5f3875e3b8b8d00ff2b5019483
SSDEEP 384:nHiF9CcmyWCbR3sN18TUNTUlI4olQckCr+BrphBftGnvuasplCddblI4H+HM8LUt:CFccpl3QwgXzkFF1GvuasCfH+QjXn
TLSH
T154D26C36D8A8C9BBEDE74F99F74A3613EFE40167858859D8DAD81E0D00872DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f19f5ab665507e6597129abb665a453afc4395bb1fb2aac3e8f69fa0b641b5ad
MD5 8534275f6eb996063e2222a16af7de2b
SHA1 c5ae76c553db0f9dc94f8f0bef11eab7eed35185
SHA512 e23f03c9ffea67e9374084269ce6107134697eec4bebd20b0634eeb84298fc7578781ed50a9abc33fbe6aaabfaf703f59c9f70beae56c02e534d595a4e26c9ba
SSDEEP 384:nptiF9CcmyWCt3sN18TUNTUlI4olQckCrQBrphBftGnvwsplrMIty/7Ig2:pkFccpt3QwgXzkdF1GvwsrMi
TLSH
T197B23936DC68DABBEDE74F89B75A3603EFE4426785C85AD4DAD80D0C008729D030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 eda3310ca7b257d93f92f4eed140cdb8d06da37be5be6eb2268e59e388d0f6af
MD5 b3d53c28431d3a254c3a274332278baa
SHA1 07a8c1585af33bfe6f8e9a515a91d662612160ed
SHA512 1b2248b235dfaa310622ab740c6dd7a924bf14f08fcf967c2ecab4aec5ae94ee4329fa56219cbf6959af659d165aa501d511b86e0fb4ee7430d9a90862931f21
TLSH
T1FD4144E25C395AD1C4BD0EAFA4D734FC95D8D62AF1A4707E6858E9A4073CA0E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e8728021bcdf29f3ab35887bde12ddbcf9c039390c4b1c10ce9c3b2dc67e7efb
MD5 e25df90a5946d7c93e4ad5f12f85c97d
SHA1 c9ac6359dda5998f62e222896a2a4acb152ded5b
SHA512 983cfbcf9a48af1fb635860baec7729388d1e66876f8bca3261160f90aef12046fba1dac86d8a2c7489fecf240a628218d67f90023e071a6527b8c8880564aae
TLSH
T1044156E25C381AD2D4BD0A7EB4D734FC94ECC725F5A4347E6C58DA980B2991D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6ebfd5903e44735510cdae02f2d356c9af6e78094d1d1aa3bcdcb4d6a1b325dc
MD5 ac04840c17a2da561c9e6814aad0708d
SHA1 f30c73354235b649c5e57f9ff2d31ca3874abd7b
SHA512 9d1a6d832b0e535fa3edeafb1302518d91bf56c1dead69bbc3addbde74bf938809f6d93594275755b2717ba5120c3debd3f615f410d6b2d13f7e855e885e00fd
TLSH
T1414177E25C391AD1C4BD0A7FA4D734FC84E8C329F1A4707E2C58DA980729A1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4a27876d2dcac298ddb3845524e78416bd08f75c7c11542ca07df28e46626025
MD5 3c5761cbbbafe5f3f4d5cccca8509653
SHA1 f7b713438ddf0ee807fbef15234d923712b3d871
SHA512 608ed68c4f46f4120ff24f32117e0bcceb93e9917a8b17073be769b80d842397e2238db85eaf2b0167458988e82a214551e35e674c4ee079cbb33a4b82e06b2b
TLSH
T17141295DA7F91108B3B3BE55ABF6A46D487EB8772F46D45E00110D4F0622A40D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download