hxxps://us[.]office356[.]co/v1/click?params=YmxhY2t0YWxvbnNlY3VyaXR5bGxjMTptdC1wcm9kLWNwLXVzLTI6MTExNjA3MjgwNzQ5MjE4NjQyNzcyOjU4NTo3ZTc3NTQ0NC0zYmU1LTRjMDQtYTdmNS1hYjdlNTk2MzEyYTM6MTplbjptaWNyb3NvZnQtbG9naW46ZXlKbWNtOXRYMkZrWkhKbGMzTWlPaUFpYzNsemRHVnRMWFZ3WjNKaFpHVkFjM2x6ZEdWdExXRnNaWEowY3k1dmJteHBibVVpTENBaVkzVnpkRzl0SWpvZ0lqQWlmUQ

Analysis

user interaction
yes
max time kernel
298s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us.office356.co/v1/click?params=YmxhY2t0YWxvbnNlY3VyaXR5bGxjMTptdC1wcm9kLWNwLXVzLTI6MTExNjA3MjgwNzQ5MjE4NjQyNzcyOjU4NTo3ZTc3NTQ0NC0zYmU1LTRjMDQtYTdmNS1hYjdlNTk2MzEyYTM6MTplbjptaWNyb3NvZnQtbG9naW46ZXlKbWNtOXRYMkZrWkhKbGMzTWlPaUFpYzNsemRHVnRMWFZ3WjNKaFpHVkFjM2x6ZEdWdExXRnNaWEowY3k1dmJteHBibVVpTENBaVkzVnpkRzl0SWpvZ0lqQWlmUQ
Sample260522-1e4b2afs3p

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_2106818929\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_3693858\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_3693858\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_2106818929\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239592965439318"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{2A8A0A77-D564-46E1-9602-126C084E957B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4928	2192	msedge.exe	80
PID 2192 wrote to memory of 5172	2192	msedge.exe	81
PID 2192 wrote to memory of 5260	2192	msedge.exe	82
PID 2192 wrote to memory of 1884	2192	msedge.exe	83
PID 2192 wrote to memory of 5260	2192	msedge.exe	82
PID 2192 wrote to memory of 5260	2192	msedge.exe	82
PID 2192 wrote to memory of 1884	2192	msedge.exe	83
PID 2192 wrote to memory of 4076	2192	msedge.exe	85
PID 2192 wrote to memory of 4076	2192	msedge.exe	85
PID 2192 wrote to memory of 4076	2192	msedge.exe	85
PID 2192 wrote to memory of 4712	2192	msedge.exe	86
PID 2192 wrote to memory of 4712	2192	msedge.exe	86
PID 2192 wrote to memory of 4712	2192	msedge.exe	86
PID 2192 wrote to memory of 5088	2192	msedge.exe	88
PID 2192 wrote to memory of 4424	2192	msedge.exe	89
PID 2192 wrote to memory of 5088	2192	msedge.exe	88
PID 2192 wrote to memory of 4424	2192	msedge.exe	89
PID 2192 wrote to memory of 5536	2192	msedge.exe	90
PID 2192 wrote to memory of 4476	2192	msedge.exe	92
PID 5536 wrote to memory of 5284	5536	msedge.exe	93
PID 2192 wrote to memory of 2140	2192	msedge.exe	96
PID 2192 wrote to memory of 3248	2192	msedge.exe	97
PID 2192 wrote to memory of 2520	2192	msedge.exe	98
PID 2192 wrote to memory of 5744	2192	msedge.exe	99
PID 2192 wrote to memory of 5744	2192	msedge.exe	99
PID 2192 wrote to memory of 3408	2192	msedge.exe	102
PID 2192 wrote to memory of 1600	2192	msedge.exe	103
PID 2192 wrote to memory of 1600	2192	msedge.exe	103
PID 2192 wrote to memory of 3236	2192	msedge.exe	104
PID 2192 wrote to memory of 3236	2192	msedge.exe	104
PID 2192 wrote to memory of 2136	2192	msedge.exe	105
PID 2192 wrote to memory of 2136	2192	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us.office356.co/v1/click?params=YmxhY2t0YWxvbnNlY3VyaXR5bGxjMTptdC1wcm9kLWNwLXVzLTI6MTExNjA3MjgwNzQ5MjE4NjQyNzcyOjU4NTo3ZTc3NTQ0NC0zYmU1LTRjMDQtYTdmNS1hYjdlNTk2MzEyYTM6MTplbjptaWNyb3NvZnQtbG9naW46ZXlKbWNtOXRYMkZrWkhKbGMzTWlPaUFpYzNsemRHVnRMWFZ3WjNKaFpHVkFjM2x6ZEdWdExXRnNaWEowY3k1dmJteHBibVVpTENBaVkzVnpkRzl0SWpvZ0lqQWlmUQ
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7fffe740c188,0x7fffe740c194,0x7fffe740c1a0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10492996148885017029,1596667806778597444,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,6004220763971694960,12471597073624223137,262144 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,6080922874930154395,7342204301498527314,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,10325532850336424084,2980558957762709413,2097152 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9603309997591888148,7946146406119863877,2097152 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,16075907544130739123,16592886230127667656,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,10518909108867019493,14035814680722070982,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,14287440047633271852,8746589634125524579,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1108
    3⤵
    PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,7605288769480345768,12099150700980587832,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,7605288769480345768,12099150700980587832,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10167772520001281855,8047939198502972718,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,6211391513766463635,4696668639935340488,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,2362519926667681280,8999758501330184605,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,16216259562531390259,6262533144395646949,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5824,i,7599707408430701167,2267588963117962478,262144 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,13801439233916043336,12682614683192577248,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,9132831549633416874,2929363784408145085,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,6576197594336077129,251686080325805686,524288 --field-trial-handle=2264,i,239017818881512626,11664154196878192352,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 17829585f228b9bcae2431f32457c7869f94062fe889bb2909ef14efee1873dc
MD5 87180d1ea2ce53dd298f83a802a44653
SHA1 3a40c6f9d404bfcb9acb8ca74a2de0c6258d0c13
SHA512 dd4e535d8037a26145dfdc24ee789bf9684fa2891241de93a692ea646c75bda671f3583912a563ea1500445257dab8d0e2349ad43b2f57d36e144771e477229e
TLSH
T122E0DF8885CCC39EA32474C7C374430C8280360AE7CCED7A5B00C8C43282E84AA966A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d7b9deda6e377f0ebd1b40fb4a5a5be048461af8aee5bc3f1484d8d6d70f398b
MD5 fa7f14b3b9785083d2348afa0de2a154
SHA1 904d80ad3d02ffbe6b59829cf2c2edf7893bc479
SHA512 971782c7a2f5830d24b8e6f6dcb2eaa89f4a6e55f66733bee43273f620767235428de76ddea8d7d41311fcf0f972c0526e4697aad99e2bd7b857cc58cbe2c3b3
TLSH
T169F02DBACC21AC3B18FD2B1D60655746E74417672F41894B3B3C830D8FB063B4945C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 188a9641b8b17e528b9d32b4613d258ad0d971d32a7a1878accb4ee22adb3764
MD5 03750eaa1f7795c33a4f47092bc75789
SHA1 280823aae3fb7e58670ee5c28ae9efef3db15aa0
SHA512 e5f122745c7710f199dda9be1be21cebb14cc083cf298953b77bb4eb8217183b9585fa65fcf688f56f63b38c1d38a90b3146a5d8f710a87db7257d885ce83b5d
TLSH
T1CE41AFF383E4856DC90196F0AA18BE2FCE2D0954436C3D5A89E4AF5B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ec9798cf1c919c3c18c5b4872477c5c7285e51dca565587b94d593113fc5c408
MD5 299be3007ee1c7ecc878d9577855612f
SHA1 426b21ddffc868b17e71c634418367573b3ef6d4
SHA512 8e608b54cc37a590d783521acb1c6f1b27329ab7ab02e888913b6e67090f52e1fd9236267551c4689c335f8864407a4cca8db85af37c9c113312281cd171c6af
SSDEEP 192:sxZrRRyMqZjK1Ml8UQGFU/fXssVKTG5GN2SwWzodpalE/W6+WNE/s/Y0hDmfIg5r:sxZr2qUU/fXssVUei23f/bn/5ATdD
TLSH
T1D272D7166A64597BCCDBD21AFA45BB53D3F91572D2904E449AFCCA0C00E6AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e3af3b3b8c9800e246e52af74deb4e111667e16f860c8bf87715b6abb2e33b37
MD5 aed4535b85302e42984ddd3e1395f8ed
SHA1 61038696f6f895cc8855547952ab093c35747778
SHA512 f88e8468de6c5c4d86b80807e72c320b612f9702771e4e7f9a748a4e4ad5dc8e10f81bd8022c8eed286b573f147f6dfc33650ae0bb69fa178fcf026dd1b195d1
SSDEEP 192:sxZrRRyMqZjK1Ml8MFU/fXsOAKTG5GN2SwWzodpalE/W6+WNE/s/Y0hImfIgj+EJ:sxZr2dU/fXsOAUei23f/bn/5bj+I
TLSH
T18262D7166A64597B8CDBD21AFA55BF53D3F9157292904E449AFCCB0C04E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 2979efba3ed779ee9759fc75258932be4dfb92af64a2247bd2e515c0b95be6f1
MD5 63e3e941ffd8022222580cdfb9fb3941
SHA1 abd80f558584a615b971ec0c9ed45de748aac658
SHA512 ef180dcf143d11c0104fab58495baa56c8fe4ff010632e49bd9b6b0ddcc43e2a14c9f0e315c20860f8c547aa9a3ab5a0d07e529ae953443eb80cb31c0f51fe5a
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F53:GZLVDJjEDPV0/ZdsL0
TLSH
T117A2580232BA02423C7D390C93979B674A42F1633069AD7F7BA940B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b13b6f1b-5d40-4fd4-ade5-9e444718ec22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b13b6f1b-5d40-4fd4-ade5-9e444718ec22.tmp
Size 36KB
SHA256 5dec1c57180a86e5fc2cee35fe9ba8e04743dc196545199c193c99c0629464eb
MD5 eb7b07e93bca5c3d7f7a2ee41dd10259
SHA1 25451f896e6cd59d1b3b33c0c1c79b272ee62b9d
SHA512 7643c6152829b66dfe389d1c5849cee128895264cd0cb36fb36bff10e34d8bcac0f185da02a081a0b6f26c9765eb232205976ae0d1bec433b5bb6fcc890962f4
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zzx4Ll8:wQAKq8y02yqEnjbWRmj1QWTu1jaKzzxL
TLSH
T1FF03FA3B680CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e7fc8dcf30865c64add82f6eeaf5913571fabc209a6c6737c0ac4b03ec2a7d01
MD5 88a6f750eb1a10689a1117d5fbc56d4c
SHA1 d36bd0e2edb977c5558ff0c319d129fac93cf81f
SHA512 68c3b36a54489d17a358c20ea007ca268e1b38c53bfe91b93687599d7144b27673f9f512854f34d782cc9626c55d40bc2f8d1387ec5d567997cafa0a73ac1473
SSDEEP 768:YF1jZbL30wgwKekmu+7eGyRLeRX2eEkzEGxk:cP3Pke92jQXk
TLSH
T16EF2B3F594D789B7E99E4B97633D6E02AAFCC153B4481994FBC80D0CCC861BFD606816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 176c122f9470f0bcf8f137555af6264da1072fae397a124618f1ca4cf55528eb
MD5 349752c036c9a93c533a691bf9a414c0
SHA1 9f4fa1dbb676734f74a606b8c7aedeac19ad6654
SHA512 7add3165c4bab890c7e781eaff2418d25c89ff81d04da97c976f5cbd561af724782a24c2a8245072902028c041c242b42bb71447881a4d4a1d35996d92cc341d
SSDEEP 384:n+iF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9BMQUs4Jfb8GgFRLCaGByMUe4KV8P:VFccps39wgPKekmUfwGyRLeQtI8p0yt
TLSH
T1E5B26C31EC68CABBECE64F99B74E7A02DEE05163858C59E8DADC5D0C109719D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c499c3c93002fdd42570fc226af07541b5bef835dd2ab77ac15928a4b631cfee
MD5 2cd7b30aa104745a5caa44a2ad1b3a57
SHA1 0ebb5bb1d7f6663a2f61490d6af26bf03079fe8e
SHA512 3a518f397dec4d258f6f7d2e780d026bf10c162ee078a56c82862bf3a620528062b4236cd2286d19e3905d9c119f20e6c5fe2ebfa99a9da2c0088b61cfcb62c2
SSDEEP 768:xF1jZbM30wgTKekm8eGyRLeVX2eEkzEGxk:fA3QkxZ2jQXk
TLSH
T17FD24B35E864CAABEDEB4F9AA35E7652EFE00163C98C1DD4EAC91D1D10971CC170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d0ed69bc4bfc64397a0a33975941d08ebdc3a117bb1442b1154b526b71cb5554
MD5 a453632a60b925826ac63801813260f8
SHA1 1a31fa908e6f333638ed3d905d90546161119752
SHA512 5bda27a616ed8ef51ee8b3169289666a940bbbccc164bb15d242b39b9a14f16c917554134ffa9f1b369614b79da6be043854ac82bfe1f6b799feb49649673ed8
SSDEEP 768:kF1jZbM30wgwKekmaeGyRLeVX2eEkzEGxk:wA3Pk5Z2jQXk
TLSH
T187D24B35E864CAABEDEB4F9AA35E7652EFE00163C98C1DD4EAC91D1D10971CC170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b16251a32202e9ae23c0ae913940eb448ce680501bf96177856745bd1a117b40
MD5 73ab91e36b0b2e77f7964f0ed458569b
SHA1 7c389383e603f4182633245ad77c2d61ca7918a2
SHA512 85533eaf8f94d69582f6e372ae7d2e13ddf3447890525144ec2ea98554878df2173daacdc109f15f6ea23d9e72264e8d00c78e34c223edb86e0dcb66b92a419b
TLSH
T1815130E15C395AD1D0BD0E6FB48B34EC85D8C725F5A0347E6C58EA584A3960D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_2106818929\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_2106818929\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_3693858\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download