b7abba5c3cde61c0447e706dfb3ae3458784f651f39f3aea6f67cb51f8ac65c7

Analysis

max time kernel
148s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arm5.html
Size 316B
Sample260517-alr98sa16w
SHA256 b7abba5c3cde61c0447e706dfb3ae3458784f651f39f3aea6f67cb51f8ac65c7
MD5 0f831e3174ae8b638f29a21fa8928514
SHA1 04046c87f1be3740e02d1966e3e6f111830a8109
SHA512 f0191024776abd7a3cb940e4a7e0c7517e012a80e8db117fa969e0ca62b006d338b64f44f3d788487d1d6d93d332b5c014ff27d79ffeda7f6cd7d86e3c8ea281
TLSH
T10EE07DDE50A2A387481125503DD026C1364953EB34B742A86EC5D44391485BDDCA52C9
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1156409810\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1156409810\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1156409810\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_840979553\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_2062519041\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_2062519041\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1156409810\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1156409810\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_840979553\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5428	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237325549845234"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{21D6E2A7-333E-4ED4-A9C1-6B3FABC14778}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 544	8	msedge.exe	79
PID 8 wrote to memory of 5428	8	msedge.exe	80
PID 8 wrote to memory of 4932	8	msedge.exe	81
PID 8 wrote to memory of 4932	8	msedge.exe	81
PID 8 wrote to memory of 4932	8	msedge.exe	81
PID 8 wrote to memory of 5704	8	msedge.exe	82
PID 8 wrote to memory of 5704	8	msedge.exe	82
PID 8 wrote to memory of 5380	8	msedge.exe	84
PID 8 wrote to memory of 3348	8	msedge.exe	85
PID 8 wrote to memory of 5380	8	msedge.exe	84
PID 8 wrote to memory of 5380	8	msedge.exe	84
PID 8 wrote to memory of 3348	8	msedge.exe	85
PID 8 wrote to memory of 3348	8	msedge.exe	85
PID 8 wrote to memory of 3992	8	msedge.exe	87
PID 8 wrote to memory of 3492	8	msedge.exe	88
PID 8 wrote to memory of 3992	8	msedge.exe	87
PID 8 wrote to memory of 3492	8	msedge.exe	88
PID 8 wrote to memory of 5584	8	msedge.exe	90
PID 8 wrote to memory of 4344	8	msedge.exe	91
PID 4344 wrote to memory of 6012	4344	msedge.exe	92
PID 8 wrote to memory of 3208	8	msedge.exe	95
PID 8 wrote to memory of 1476	8	msedge.exe	96
PID 8 wrote to memory of 356	8	msedge.exe	97
PID 8 wrote to memory of 2752	8	msedge.exe	98
PID 8 wrote to memory of 2752	8	msedge.exe	98
PID 8 wrote to memory of 4948	8	msedge.exe	101
PID 8 wrote to memory of 4948	8	msedge.exe	101
PID 8 wrote to memory of 672	8	msedge.exe	102
PID 8 wrote to memory of 672	8	msedge.exe	102
PID 8 wrote to memory of 4240	8	msedge.exe	103
PID 8 wrote to memory of 4700	8	msedge.exe	104
PID 8 wrote to memory of 4700	8	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\arm5.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe1f85c188,0x7ffe1f85c194,0x7ffe1f85c1a0
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,10864662625815006896,11262248171476421693,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,15944274806034065743,12069623371423468520,262144 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,16237035026216839555,11904715975722680333,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,16996774243756333329,13873038027779617524,2097152 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,1837553343993812331,17994227115552006670,2097152 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,8862589672417630333,4904443513245968029,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1196862354370042429,13237033924651624265,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,8732319169564205927,5326484576544618729,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,8732319169564205927,5326484576544618729,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,17094211647995481807,14303470671371653060,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,2334270813235581950,15682873784467164564,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,3115086631384593754,15478153359625434999,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,15711673360254923350,12697384960091274863,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5431887888732405211,1000141456399289914,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2914509349848570612,2583901224553947301,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2083840616323300138,12090022859461359904,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5204,i,10523475813343937955,840325426980734429,262144 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5400124207385675796,1595174361562249631,524288 --field-trial-handle=2192,i,14964401666350905723,6179310810820614958,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a5272c30f7526ed719d1c23fbbf2a664ce200da98fc69918ab7f8ba4f20903
MD5 6aa2adb89bcc3973e622b85ad58e38ba
SHA1 020c781359a16ce1fa10f7a593ad7c6340efdaa6
SHA512 4cf00a3ebf14f3e625dac910de1d979319d596fc2722ecd93a3f31abf0bfd41f91e9a194434fa57d1628921a8c4084484706fb480c5d18522aceabb9b28a19e8
TLSH
T134E02BF6C8229C2B08FE072979941745D70113672B40591F373D820CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d28da8ed9a33e66a3636b03cf29cec5cb89abe147975ce62ef23b32bddd7de63
MD5 4009ee9248899a30d5969f85cdf1cc96
SHA1 0c7f03f024da32d1e6f30def600a3a95b4d3b4c0
SHA512 99020a3fb364f978841121f059a1fbe68520f2c475406a982534024816f54c0abb92fa4734cc84559d1f8c4e823d45532b5b196af27279dd8751db5492ee4438
TLSH
T12C41AEF783E8856EC90195F0AA18BE2FCE1D0914432C3D5A85E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cd6f91eb1dfb16875c0b5aed5699be7f759376ed519e23f9c2d2c1e2aecbb1e9
MD5 c80e36ff61652fe0b593b3c118bf2026
SHA1 01c2dc31bc8dee1fca973f6c0fa8f2c1d9a6c4a3
SHA512 759d58d0a5be5bbe21e4433e5f4b42faea39a57e7e49db35a36c99e0c8e94f463ecaa724f47eb524ce966f610ceaef8d9396bfd21c6ece486856cf340bb42f11
SSDEEP 192:sxZeR2yMqZjK1Ml8MFw/fzsVoKQ7PgYsw0SzodpE//W6+WNGY0ZkxzIgjJLCJ:sxZeLdw/fzsVoV7orw0p6/bG52jJLe
TLSH
T19762F816663899778CDBD308FA457B53D7F9166392900E44AAFCCB0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dca3de9aa1f7d501eb71438c666fbeba8a31ea6dbca6e5a1e86f8d31041afcba
MD5 bd22544a627465bf66aed152ab39b8b1
SHA1 06c23231b217f06a0d807e244ae8e4c6ad029c1f
SHA512 109ebff939b9d78e41a2dcda46db69d237f931861365c23f2dcfb29818cde6a95da5cb71ca4a55d862b90b032a36b72b423f85584ea05487f7ae9f0a7b4ba284
SSDEEP 192:sxZeR2yMqZjK1Ml8UQ3dFw/fzsCfKQ7PgYsw0SzodpE//W6+WNGY0ZGxzIg5GLwJ:sxZeLqrw/fzsCfV7orw0p6/bG5EgLU
TLSH
T140620916A63899778CDBD219FA457B53D7F8566391900E44AAFCCB0C04E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 eaa746be908afb17591ce1d6a7726a6ec3792547b305038ed6a9cdd92cfc44bc
MD5 eb0e903feaac8b25aef1748c431a1a5f
SHA1 1105cc0b16371c1270af5a95492bafc8492d2f8e
SHA512 5993e842c037da08f8c4637c4d711f672fedea0d96e44a1bfa0baea1a075d15703a98e8f664cefb03f8e3c26d09e1ce58c08cda54d5653ec4dd3acfcb27912b8
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3gGq9LlT:XwZh38Dv2SkEnZFWRm6GQFmu1jaKgGqz
TLSH
T159030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b1bf7b5fa17f468b84f38f48dd2556881599e664869c411f011b631fa78522ac
MD5 8367f43cc76d05b8fcd8928538dc1b93
SHA1 eebea0df0e23cb53b8acedd5987e75f20be66ad5
SHA512 877480d112ded313e947006b87b3c5138ba3fa33e1ca77993204b663b7a75cf4fbf4c022bd43b3bc07805e5253e61fd32b6d03d8fd10a9a8a4d54127bb965a06
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlxhqVExFzH7m36J9pZZA:ctGj+BCNC5qFVpKxxpK
TLSH
T157B28B1632BA02023C3DB91D87A597375A42B1A33418E93B7FE854B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9da3743-1094-449e-baf2-dab1baabb5be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9da3743-1094-449e-baf2-dab1baabb5be.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c5f5f8ff103f1e20082808d8531f2941bc6740c41c81d3f445e797e275446a9a
MD5 8bdcde661c319d6042316508208a4ce1
SHA1 e46c38fb8590b21849cfb19001e9b5c874ee0294
SHA512 9b14d0f1ef5d9045961f67c2da6391de97f72f0904d67be659d60494695ad67deeb7043313e8ded0d632b3c5a6ccefc3349a7b2fcf0b8de44b0d666966d78e9b
SSDEEP 384:nPiF6CcmyWCl38Nd8TUNTUlIRfrk67orP1zCfbLokITX05tAaY9RCddblI4H+HR8:aFRcpl3uwgCvZOoR70caYrCfH+Qyj6n
TLSH
T1D6F2C4F298DB89B7D8AE4B97A73D2D029EBCC15775484988FB941D0CCC461BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 db25c0b5f05c27ab54507aad7944712ebca53e5d7459aa369450188359a7a4cd
MD5 165eeb62e24af4c9305310c747d5d491
SHA1 159f3fc00d98ea1c769f85557bf56bdb1a344001
SHA512 2bc1073a3741ac906890b83db7e6c8b7c6388e03948072d14ee6cba3225f34fdb308dbe8dbcb097908e629b6dc17dafbf339f0cf354ac119e4047bed4627be49
SSDEEP 384:npiF9CcmyWCs38NB8TUNTUlIx0HOrk6oej0F1zCfbLokI4SYJe4KV8p0kVty/7Iv:AFccps3CwgqHFiYzOoR4SYJI8p0kt
TLSH
T104C25C36EC58DAE7EDD74F98F74E7603DED0126785889AD8DAD81D0D008B19D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b4baa2b1153c2406fe82a46fc3bef63262096e787d3cfc67a22d9b004a09ac86
MD5 849528a137d98a36774e4ef6c0a12764
SHA1 e28a3b3ba88ec38562eb1472da23a52c730cfe22
SHA512 63f6eaef1cc24febb4445679094ffa0bc9982ed34f1d3e98025da846f46b1bda09bb1d27a960817b0057220a077005fecbd38ba2ba655fba5efa09fe3b699750
SSDEEP 384:n1iF6CcmyWCj38Nd8TUNTUlIRfrk67brP1zCfbLokITX05tt6Y9RCddblI4H+HR8:8FRcpj3uwgC+ZOoR70h6YrCfH+Qyj6n
TLSH
T1E7D25C76ECA8DAA7ADE74F99F64E7603DEE01167858849D8CED81D0D008B19D530FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 834b72238ba21e380197b8ba18bc585738109f20301fb29dd10f934b8a423641
MD5 c3f245c95bda141ae4e36d35a64251cb
SHA1 28489d04266f61bfd9496750e8b1874087e7e4cb
SHA512 8b1d11b667cdd47bf8b63306a46054cb108f555bd4ca7d931c763a84baa17f38e004b9bf97a74bd3a71b9ac8ddf06f7d64ac8b383b2099663115a4bce7a500b1
SSDEEP 384:n1iF9CcmyWCK38Nd8TUNTUlIRLrk6NbrP1zCfbLokITX05tt6Y9RCddblI4H+HR8:8FccpK3uwgCsZOoR70h6YrCfH+Qyj6n
TLSH
T1F9D25C76ECA8DAA7ADE74F99F64E7603DEE01167858889D8CED81D0D008B19D130FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f676ebf3bafbee0ada126b37483889bd84427d665736bbff43fe7da89d367ab2
MD5 12515531f1ebd774bcc6ad0cc6a195b6
SHA1 2e256191a9baee7e8ae21e7d2017a1e17a8ab212
SHA512 95727aa295b8ed2661d390fd4d90ba59a87176b8d458ff342978451555a97266752c8aa50289201abdbc14b7c606342ca59b775b9d8e8e0204b28cf8ff970b2f
SSDEEP 384:nViF6CcmyWCj38Nd8TUNTUlIRfrk67brP1zCfbLokITX05tt6Y9RCddblI4H+HR8:cFRcpj3uwgC+ZOoR70h6YrCfH+Qyj6n
TLSH
T188D25C76ECA8DAA7ADE74F99F64E7603DEE0116785884AD8CED81D0D008B19D530FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c9764740e2f4c33b84cda5aaaaab62ed7592c41584b9eeacbfe8221e5f3e31b
MD5 50f9f73222fe38fc2d58ffa519fdb3f5
SHA1 6a036891fa9874dc297593786e8990a442209f45
SHA512 83eb35725b04bebee4bd90ab6fb3f840a46a9a8dcc749f211b5f66b321defd5ebfddd7ab4894fbbd5a76b1123ee1cef87057c5c69d2b18f59270572547624baa
TLSH
T13E516FE04C7D6AC1D4BD0E6F60CB34FC82E8D625F5A0347D2868EA950A7962C74C583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9bf99640fdfbed02ef2f85ad399e6c25e8e60f1aaf56c7adf578fd25cb509418
MD5 59d807b808fdbaca146759ccf4a32a35
SHA1 ad88c881aba2d0fe07d4afb27144dcb98056bf13
SHA512 a3bf24e12b167c32a6e0c4cb15c8a8f011e95b634fd5c8b0360e1170fcc3036c96941aa7675a2f9548a5aa49f9a2249dbe3e79da84df04a6261504b68453895f
TLSH
T179515FE14C7D6AC1D4BD1A7EA08B34FC85E8C725F5A434792868EA990A79A2C34C543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6d963e3246937d1dd14425e249a31873f90f5e7263d11d5d8c9c3e9a13f60f9f
MD5 a6b4f5718d59bfb586cfe7bc6fe5b2bf
SHA1 b8fb2c087aa8319d31619532608a37da3f56267c
SHA512 bc22701d58b522890b53d8aac5bc12dba17381f7d48a9bb9c3e816ed6a0ed9b8920975888748eb22d62df44c6af9ba461babeca1392ae38038095e0e6a514949
TLSH
T1C5515EE14C792AC1D4BD1A7F608B38FC85E8C725F5A434792868EA990E79A2C64C543F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1156409810\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_2062519041\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_840979553\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_840979553\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5584-166-0x0000020290CF0000-0x0000020291CF0000-memory.dmp

Download