e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_5734aea2-b946-4408-b312-ed8979b975fe.html
Size 42B
Sample260519-x5k2laes2m
SHA256 e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0
MD5 fd6866f1634d734f9daa7d1900967fa3
SHA1 983b472312cb71278da6849490e9590d080c3bc3
SHA512 69461bf87de3dbbb1ef07d2f33dc4d0c309a31a85fc91ebdc09d30af7ada57de56744d6df8d2eb3e6062afcf44396cb333394844af5a9b8ea12a9fcef88aa730
MD5 SHA1 SHA512

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
984	msedge.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_173030009\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_173030009\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_1686780432\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_1686780432\well_known_domains.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_5222898\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_5222898\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237127927596616"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{E9AFE94E-EFDD-4222-82FA-290499EF1389}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5800	msedge.exe
5800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe
984	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3028	984	msedge.exe	80
PID 984 wrote to memory of 4412	984	msedge.exe	81
PID 984 wrote to memory of 5792	984	msedge.exe	82
PID 984 wrote to memory of 5792	984	msedge.exe	82
PID 984 wrote to memory of 5792	984	msedge.exe	82
PID 984 wrote to memory of 4540	984	msedge.exe	83
PID 984 wrote to memory of 4540	984	msedge.exe	83
PID 984 wrote to memory of 2860	984	msedge.exe	85
PID 984 wrote to memory of 2860	984	msedge.exe	85
PID 984 wrote to memory of 2860	984	msedge.exe	85
PID 984 wrote to memory of 5220	984	msedge.exe	86
PID 984 wrote to memory of 5220	984	msedge.exe	86
PID 984 wrote to memory of 5220	984	msedge.exe	86
PID 984 wrote to memory of 1984	984	msedge.exe	88
PID 984 wrote to memory of 3800	984	msedge.exe	89
PID 984 wrote to memory of 1984	984	msedge.exe	88
PID 984 wrote to memory of 3800	984	msedge.exe	89
PID 984 wrote to memory of 4136	984	msedge.exe	90
PID 984 wrote to memory of 4936	984	msedge.exe	92
PID 4136 wrote to memory of 2456	4136	msedge.exe	93
PID 984 wrote to memory of 5504	984	msedge.exe	96
PID 984 wrote to memory of 4236	984	msedge.exe	97
PID 984 wrote to memory of 3012	984	msedge.exe	98
PID 984 wrote to memory of 4848	984	msedge.exe	99
PID 984 wrote to memory of 4848	984	msedge.exe	99
PID 984 wrote to memory of 3508	984	msedge.exe	102
PID 984 wrote to memory of 3508	984	msedge.exe	102
PID 984 wrote to memory of 5028	984	msedge.exe	103
PID 984 wrote to memory of 5028	984	msedge.exe	103
PID 984 wrote to memory of 5800	984	msedge.exe	104
PID 984 wrote to memory of 1932	984	msedge.exe	105
PID 984 wrote to memory of 1932	984	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_5734aea2-b946-4408-b312-ed8979b975fe.html
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc182ac188,0x7ffc182ac194,0x7ffc182ac1a0
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9706705363232866492,10451799599581443122,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,3547574736775110950,14221042077050619644,262144 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,4158517401077188309,12384897035918771029,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,18175068886995102320,2187534651905374974,2097152 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,10782141485803344331,9953833734286569209,2097152 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,889820928627012001,15549626259420344831,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,17890781042737133381,3476559075782250360,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,11382144575218434600,6833854977417828891,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10737116004374532424,3765348463867544016,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10737116004374532424,3765348463867544016,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,11619759831795124360,13365803542636848390,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,13067212470150019053,14928799293761477349,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,11294522569174210035,13774397676719369234,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,4329279798100806420,1297254194024402858,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3745670439212944222,5014369449810695176,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13094379380164344718,2859143402285249011,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,18442291097027074321,12526161830396692803,262144 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,10729829099675286912,17383958988788711119,524288 --field-trial-handle=1888,i,16157530021176331458,4343986533432050984,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 10ee015d29741fe94af81d0a6535c5b3f782e97ad971fb734314cc5460f3ee15
MD5 af70c74fd623569a6886845df808c7b0
SHA1 7283b96e2f363cbc77f18528037083c05d35df01
SHA512 1989349535147875e0917a7a35fd2cb1e1e741f5846462d938123b7666835145a4ef31f8ab92bc28673bb22a4f5729a6332b08190fb5ceef7804d0088c45f52d
TLSH
T193E02BEACD21983B09FD271D60546745EB0413971B414A4F3B3CC1088FB163A4685C7C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15878c65-d5b3-4eb8-907d-e99ea000d829.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\15878c65-d5b3-4eb8-907d-e99ea000d829.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 45254efe6f0923a1d99d990813a6d77946a69715839909d4b2c9a2bddd33bff5
MD5 db64e81653a7fe1a8a739f494065081a
SHA1 8129fb789961d2212f4e53fc7b39603c4db013ae
SHA512 5210e71ad88c5944a97dcfb3f0a9dd41c4e6eb0300051fcb67b7a10eb9e192a57f210f2dba43524da215eff1ab0f71606130912bd6396edb7a76c62998612a46
TLSH
T12C41BFF3C3E8856EC90196F0AA18BE2FCE2D0954432C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 019cc99637e6be9df780ea904eb5ce48c4fcd6f5391eac2b427a0815a3b4b605
MD5 64d1bc5532a1afc339714184f4ea88f6
SHA1 de81accc0b3008e2fdf5beb76b5462641a98d13d
SHA512 ca8a8221487a3c005f36ed5f07285a4d6087e0de27de3afa3d3d6f83793b533caf138b4b19c311501bc9becb0f1007735803bd687b753a126cddd00f83cbb975
SSDEEP 192:sxZDRnyMqZjK1Ml8MFW/fBsS+KTG5GN2WwvzodpEk/W6+WNGY0ht80Igj+OJ:sxZDodW/fBsS+Uei2qZ/bG5Rj+a
TLSH
T1F762E8066A68597B8CDBD319FA457B53D7F9157292904E44AAFCCA0C04E6AEC2213C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 694418ac45db881dafdad5113cb4c54176bac0349a8828a06014b204e0137329
MD5 2f69564cc4e211ca7a7e8186b5d2b1ad
SHA1 b222f9ee725893aa75a0e8613da0ff0602a895c1
SHA512 f5c184592d56c76a2685941b90b8e34664803140e443db41ca59bfb06507c89d8544d46850debfbfb301bbf289723a3047e1818c26007639b3096c9e3e2e5642
SSDEEP 192:sxZDRnyMqZjK1Ml8UQpFW/fBstcKTG5GN2WwvzodpEk/W6+WNGY0hP80Ig5gElJ:sxZDoqvW/fBstcUei2qZ/bG5rGEP
TLSH
T13862E8066A68497BCCDBD219FA557B53D7F91572A2904E449AFCCA0C04E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 4585fd2262cc468dbad8f5b17018ce206008fae872da51ac210d980e2995d6c9
MD5 a6684a3bd61d741a7fba2341da014dc2
SHA1 93f08d6e50506655a18086580c3206d1e8d2f3d7
SHA512 2220a6a7dd65cd96a798c7a4aaa7d826f3b24f9107d9ddc578a4cb1a6135fcb5c230694697241fe1a3d5b3d22e7ded3c08119179c3eb1e9ef93adc4fade6f690
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nzx4Lls:wQAKq8y02yqEnjbWRmj1QWTu1jaKnzxn
TLSH
T18603FA3B680CCB7E4F804E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 ce5f40bddf5406a248aec4ff66515b1497127faa1840f30c73bd6ad005a66de1
MD5 edfd3882e92b2c0be46d3db536a47c33
SHA1 1321216030ac8c3d3209d79b39c9d2ea1f5865a9
SHA512 971b3e1ddd0e9176a2665ae8023b620604d531f0cd9d92c2bd804481fafabd67443395014d8c9897fa4f7bb96ae632465bc373178baf846a4ad9c8737998f60b
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5z:GZLVDJjEDPV0/Zdm/e
TLSH
T1DBA2481233BA42023C7E290C93969B674A42F1633459ED3F7BA940B54E67E125EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0667ba0729ccc444f3e6d36c1f37cb1c49d0c3cc075d267b5c201709345840ae
MD5 10d78473db1e564001e09f87773acc62
SHA1 0cfd8f85d41f70a7dc70b7332aca0ba42bfdd4b9
SHA512 3a31cc9428b351d9f4e0f042e90b7e50c6f8357367d1e0d8469fb91db0cc4372247272c7aaf978bb273718d6d3c549cfab64ac65483073e3ade8dacd67f50788
SSDEEP 768:tFlcp63ewghKekmzyGdyKpwsrCfH+/jhn:Q63Uk+yK9rjR
TLSH
T14CF2B3F298D789B6D99E4B87A33E6D129EFCC153B5484994FB980D1DCC461BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e2f7ce9208283edad55657852086e79c4a060714ea6d0aeb8fc2d6c9a2decd79
MD5 d86e69e0f0cc194f4327f34052f03622
SHA1 d11bfe8fa3c5949f3fefa3d155ec2c3f6c8b240a
SHA512 92951ec50c94043eb3f7766c6cc6b0bf661aa57895264c069e5b486e85778c0e483ac826e9f20497e8b0c931a24aefe0703962651d695ee7ce9e8bf4e734baf2
SSDEEP 768:gFccps35wgqs8Kekmz390GdyKphsDI8p0J:os3Cs0k03hyKQDI8p0J
TLSH
T1F3B25B31ECA8C9BBEDE64FC9FB4A6A17DEE01163819C59E4DAD81D1D00971DD134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 242fa952347d7df85ed1fb4b2f38fdf708917841e3ce3d10d127fb688c10fee5
MD5 e7166c5648ebac5ec367559da3b80e72
SHA1 e5dba1406a7419599c7cd8825dbcef6074343eb8
SHA512 388e14297ba0165c84d03823002341c751750569964d6aa2e111bd333691a1440f1af38f41e0c422e6888e72a01178a634dedd0890f787ce1bb229067896990c
SSDEEP 768:4FccpV3ewghKekmSyGdyKpjsrCfH+/jhn:wV3wk3yKqrjR
TLSH
T1D5D24A32E8A8CABBADE64F89F74A7613DFE00167858849D8DED91E1D00871DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c9f2d0224b1d510a1d9fe99eda43d9d9b5dd6a39bdd5a41fb3c6699954b5c8a7
MD5 4df1f419c688420f8e37c6587ab6c75a
SHA1 b9d94a451823825e48548b001c92040fdf096687
SHA512 54be6d69b86e3f880afc7676d105d97422393950e9994c6903bfc0d32f2f2fea45d49514ea3b3e9a220b063cb13089956fd911699ad66540ff24ac853c3ef8f2
SSDEEP 768:4Flcp83ewghKekmsyGdyKpjsrCfH+/jhn:X83UklyKqrjR
TLSH
T16AD23A36E8A8CABBADE64F89F74A7613DFF0016785884DD8DAD91E1D00871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d248af9a73801a460b6d4142e89f19ef0a6bd51304fd3f61ee4ac2522c3b1964
MD5 ae612a388f364d9ac6464198847519b2
SHA1 1fe301c157abf51bce77372451abbff73b891877
SHA512 7faee7eb4985679ed9fdd7362e98fc898ce08fc7a629cec072bd3cf4cd78e0cc50ca8f0cb25b60581fac2232c9c3edf65089c17af050fafd0693d4b531714c58
SSDEEP 768:LFlcp83ewghKekmsyGdyKpjsrCfH+/jhn:e83UklyKqrjR
TLSH
T16ED23936E8A8CABBADE64F89F74A7613DFF0016785884DD8DAD91E1D00871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2d60d747fd90cdbe731756286fd2502191b0cf94423ce04cd94e97227c06dd98
MD5 7e31e7727f292c2a942ed5e9043103ef
SHA1 38217429b91081c021db2a221b4103c3052b8dbf
SHA512 04f4b7fa47125cb07cde189152af5078816d7f8a12dbb854bf29d65a6b273521f477ba6170012fd1b9e9138f4501e1b8c1114159aaf4400aa39ecb061cf40f83
TLSH
T10A4122E15C3D1AC1D4BE0DAFA48B34FC94D8C326F5A4707A6C68ED644639A1E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 17843d217743888d4235da83df1dce7f4bca85be25aa4c97b0316c2d99fe77ad
MD5 15b8dc2f4eb29d408c6d4ca1178c3dc3
SHA1 16f09f881406e6f569f5a6b69c85308814b38ae3
SHA512 e1f58807ecf32b2aa95681bbe8e699b72d985a989ba18a271729326986901270462bac4ff21e4bdec693b2cb1c79f27df72c7fea93d8d57bc60344137efa69e6
TLSH
T1754143E25C3D2AC1D4BD0DBFA48B34FC94D8C326F5A4307A2858EE68463951D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c4383b57d551749f06e6e73e0fae63b0a4c819f80525609b6ff753f47572608
MD5 c4b2602defc9d85b9ec6ea51bfcd6801
SHA1 2ea49efbd102ecdb16bd003dd152cb408bae3850
SHA512 ca7a44fdaf6754d5b18ecbfcc7d4297371c85ec0a51e64b1d01b9c9d653358b5850884b6d48db6f7def349283d2a8f3b33e9eda8caad2186bd434eba5ee01888
TLSH
T12F4142E1583C2AD1D4BD0ABFB48B34FC84E8C726F5A4307E2858EAA8473961D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_1686780432\manifest.json
Size 141B
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35
TLSH
T134C04C5185005D72509D87781D6C97054B12CF4618947509DDC68309EC1DCCB64B234E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_173030009\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_5222898\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_5222898\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4936-165-0x0000027600000000-0x0000027601000000-memory.dmp

Download