06a5e250394348f963c8b503b273b34f291789bd0f9807d2c6391eaf68f2df83

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
246306.html
Size 7KB
Sample260522-pekddac161
SHA256 06a5e250394348f963c8b503b273b34f291789bd0f9807d2c6391eaf68f2df83
MD5 b676f7cb625da3d542ca8c325e610316
SHA1 be2e1d441bcf5493d53eba5a2e7a7c0c491bef77
SHA512 9fe7a611d68edba37927f43058d0d7620906bd4d167a10b744157967276d95a3b9ab5585a06e11c8632d3ccac73d1bc072626b65ae5fb564f0986104c8f8ed29
SSDEEP 192:tupmVQX8HVvWc4p1hmRk2nPc1yBIfZ/gQC:tupwlLMN5C
TLSH
T112F1954364B20156301AB0A1AB387B09D752D347D24ADEE47AFC26E8DFD65C1C9E728D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_623101022\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_623101022\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_46878442\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_46878442\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5996	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239259290616988"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{0B2509FC-2C00-4E0E-ABE2-B1C9570DBB2B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1464	2516	msedge.exe	80
PID 2516 wrote to memory of 5996	2516	msedge.exe	81
PID 2516 wrote to memory of 5456	2516	msedge.exe	82
PID 2516 wrote to memory of 5456	2516	msedge.exe	82
PID 2516 wrote to memory of 5456	2516	msedge.exe	82
PID 2516 wrote to memory of 4028	2516	msedge.exe	83
PID 2516 wrote to memory of 4028	2516	msedge.exe	83
PID 2516 wrote to memory of 2768	2516	msedge.exe	85
PID 2516 wrote to memory of 2768	2516	msedge.exe	85
PID 2516 wrote to memory of 2768	2516	msedge.exe	85
PID 2516 wrote to memory of 1740	2516	msedge.exe	86
PID 2516 wrote to memory of 1740	2516	msedge.exe	86
PID 2516 wrote to memory of 1740	2516	msedge.exe	86
PID 2516 wrote to memory of 2076	2516	msedge.exe	88
PID 2516 wrote to memory of 2076	2516	msedge.exe	88
PID 2516 wrote to memory of 1224	2516	msedge.exe	89
PID 2516 wrote to memory of 1224	2516	msedge.exe	89
PID 2516 wrote to memory of 5328	2516	msedge.exe	90
PID 2516 wrote to memory of 5292	2516	msedge.exe	92
PID 5328 wrote to memory of 4164	5328	msedge.exe	93
PID 2516 wrote to memory of 3264	2516	msedge.exe	96
PID 2516 wrote to memory of 3228	2516	msedge.exe	97
PID 2516 wrote to memory of 460	2516	msedge.exe	98
PID 2516 wrote to memory of 2424	2516	msedge.exe	99
PID 2516 wrote to memory of 2424	2516	msedge.exe	99
PID 2516 wrote to memory of 2560	2516	msedge.exe	102
PID 2516 wrote to memory of 2560	2516	msedge.exe	102
PID 2516 wrote to memory of 3256	2516	msedge.exe	103
PID 2516 wrote to memory of 4780	2516	msedge.exe	104
PID 2516 wrote to memory of 4780	2516	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\246306.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe1657c188,0x7ffe1657c194,0x7ffe1657c1a0
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,846174809004187235,3753981956280904514,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,6660182036287718596,301559276294938473,262144 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,18076291829519645498,14820080416007689335,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,6121639933146262456,16304072289217607447,2097152 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,13078557658456058158,13249575987337820740,2097152 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,12077400576495122336,9659332810238353666,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11442147143338359705,2727847102225021558,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6890680404090531414,9703890165464262557,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,3866653198770899925,3326168577046923550,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,3866653198770899925,3326168577046923550,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,15668815246426914183,9501026075887145225,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,12353227344453894719,2116682295429415929,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,17953134168650502167,2099767043305142291,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,9227177509906033252,16378873830788331171,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,10222487726694911128,5894418054938704378,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5848,i,1394026994186278973,5301362907726152045,262144 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,6911615484716008459,15773660546519014309,524288 --field-trial-handle=2208,i,499268439820786675,16643774641336308468,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 94055a5e2f40fe79dfdd7122889dfece72d6beaa6330a6e83ad128ec3c7493fa
MD5 1f0d824cab9caaf7ecbc6f63843927a6
SHA1 f30913015610b76c00eb8868c175bf25c054a2f8
SHA512 d93c27e07ec8e13e360698b2f6104c2580f59415c42a3ac1a871714089f1ab89fdc159950a2f8c57f6324f9fefa46a4ce7092272ff4984a99ebef16ed29db823
TLSH
T1E2F0F9A6C921AC3B08FD1B2960645746F74423672B41895B3A3C820D8FB563B4545C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 336df0f69a59d83605e361b7ed02dfcf2c22e70bba67c93df4832520d0e1fe59
MD5 2d7f4140d478302580f3cbf4d41d514c
SHA1 fdd11c723b02e2d0f34a3703cdf2e56054b6b626
SHA512 ae62aa5cb8633a25335940dc4ca06b8ef203a6a346877a5a89fd94f8fc4fbf8ef4e73a4eae658fdb01e5d9458961bf32f612dc5941e9c1bed3071e0cc7fe88c2
TLSH
T118719CB7C2E8826D881156F0AB257E2BCE1D055A53283C5A89F4EF5F63E2470D24169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 55e7bb2b39727ca366158f9080b9af5cd69dae7430ad443b099c1d5c2f5a8b50
MD5 593d97423142187f47391dd391617c04
SHA1 50dca12e7af83cdd0f43de4614d977b6abfe9818
SHA512 9d558dce8de6ad6cf6fac70f9f456b49566e324cd8f2a36fa704f15b589a58dd3a4f8fad8606d38828e798af4d9cf2b617bf3d881575eb37af37106409a82d97
SSDEEP 192:sxZaR5yMqZjK1Ml8UQYFB/fwsZbKTG5GN2ww/zodpEs/W6+WNGegv0huv++GIg5K:sxZaaqOB/fwsZbUei2It/bGeZo+dYdd3
TLSH
T1AC72E916AA68497BCCDBD21AF6517B53D7F9157292944E449AFCCF0C04E6AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7064a0a67a7a04d3483ddc656a4b4e48a6df9802a9dec69eaa92dce7bfc017e2
MD5 3264077823539107a9c93827af7df1a2
SHA1 3d8c47a0bab7789c6420de61bd0a0f53c5f59957
SHA512 42985fef95c01a6e886c1eb9e4a93a4968008280946b1c1c304f7cbd1e19244f1a48e5ce3aabcf829a7ea48933e7f481164a9e888a31e348c091d7b71033c10d
SSDEEP 192:sxZaR5yMqZjK1Ml8MFB/fwso1KTG5GN2ww/zodpEs/W6+WNGegv0htv++GIgj+pJ:sxZaadB/fwso1Uei2It/bGeZX+dj+T
TLSH
T13062E8066A64497BCCDBD31AFA55BB53D6F9157292944E449AFCCB0C04E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1c42f5dc7ba6a542d98529eff0bbbfacc68c6a15601959b70a668932aca5f870
MD5 f9e53a385b341da55d0b94f0a90830d1
SHA1 249f58e51e437e8e15c4d4bdf91bbaedc232e9bb
SHA512 3af0f61d899c3ced3f391995462e75dd4b210e698521acfcc97580f67627227b739c8e6a474c76dc08deee2f6db5cd89011e5a7b318a7c9e435089a95dd106a9
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV30zx4Lla:wQAKq8y02yqEnjbWRmj1QWTu1jaK0zxd
TLSH
T15F03FA3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 c87a3e93cfa858481ecfa0f31ef5cc6f6e149c1f235ff18f9cee3feaafd3ce3e
MD5 62aaf3154cb9ee3f86c70c91273ccb8b
SHA1 2d9d7b39c76ba8333fd43a39db53d5e71f1cf14b
SHA512 e0e509bb6b38509d073419bbb36cc90b01365ef9eac76bcc0953ea331118ab0a7205e3d151aea097ef326e95685dac551fb80e5031a27396ed260528028c1ff9
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F53:GZLVDJjEDPV0/Zds5y
TLSH
T1CAA2590232BA02423C7D390C93968B674A42F1633469ED7F7BA940B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d18765f99b9f5466fddf92dd011baefe17924cf02a043999ebd7dd07bc84c786
MD5 4cc319350273ea5f4ba5e8c098c48a27
SHA1 f224a137621851fa51dc3b944295dec7a47849c2
SHA512 cc985adf4d857162b4d107311e0827d643a66847277dbc644861e918c45f156afdc06c467bc7e65f5afd30ddf55df0f9a4ed817a95484f441d5477d74ca548a6
SSDEEP 384:nDiF9CcmyWCs38Ns8TUNTUlIxBPm3ek32nn9BJQ/s4JfbgG2DT+b1ZUOe4KV8p0J:uFccps3fwgPKekmRQsG2DCrUOI8p04U
TLSH
T185C25A36EC18CDFBECE64F89B74A6A06DEE01227868C89D8DAD81D1D00971DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 61a41239f909ec86c82229ce8521082a71ae1536f4f979a781ea997931279818
MD5 95e7b97a658f04c5fa0bab3741d8274c
SHA1 0f53bde6b158f35347b4fcf568d47c9530ee7f9d
SHA512 2cbd13383fba1748a878383e6b67a884471fe3e3329cf0eb72c9b1e4b5d9bf9b43d6e415eb6ea3ed15eddd76ee256f00c2bd7084880df1146cc7d0945fc2b889
SSDEEP 384:ndiFwtNnNnb9OiR38NH8TUNTUlIRJPm3ek32nn9TEO4JfbgG2DT+b1Za63whg2Gm:UFwjZbx3owgXKekmiSG2DCr7w2lPJEN
TLSH
T1CBF2B4F598D789B7D8AE4F97A33D6E429ABCC153B5481984FBC80D0DCC861BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f6245f302da2bfbbb84e592c1ce37585da7d3f1d950e421ef4455f67120f5580
MD5 ccbd10f89b7ce0ca306aa5298c99bb6c
SHA1 e4acffe9e82f56cc3542ea370f78a86602a33ce1
SHA512 c7fb2ef8bee86dcb2d7cae85f9ba91f6b7ac3430cb57a4ab534f9564932079ec80606d0d7fa89bf0b94d115915337f2032b405aa317a01c990e6d7654dad0f3a
SSDEEP 384:nqiFwtNnNnb9ER38NH8TUNTUlIRJPm3ek32nn9TzO4JfbgG2DT+b1Za6Hwhg2Gl0:hFwjZbI3owgXKekmVSG2DCrDw2lPJEN
TLSH
T119D23B36E824CDE7EDEB4F96A31A7653AFE00163998C1AD4EAC95D1E00871DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c63b2500f507f1aac917c9d47d39e4df9618b05f78da2338f954972c9ef3cd6d
MD5 16f690019c2c0be0a4a84df04ecb8918
SHA1 34fc099b0a2a12acb57eb80137d2a87403a7ba0a
SHA512 171479f56f942636f82ccc57a53d148bde0394db8e2282e42747586b044d39cef3c7de02c3ce913728268c8f92da5edf503bad25b53ce855e67f12c3d7916cdc
SSDEEP 384:nqiF1tNnNnb9y38NH8TUNTUlIRFPm3ek32nn9azO4JfbgG2DT+b1Za6Hwhg2GlPs:hF1jZbM3owgXKekm2SG2DCrDw2lPJEN
TLSH
T1D6D24B35E824CDE7EDEB4F96A31A7653AFE00263D98C1AD4EAC95D1E00871DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8ecd43aeb15e958601f58ac39e2b9d27564c5dddf151c4df80d7467adf7a4f8f
MD5 066b1985187b031f2874c824c933df60
SHA1 fbe1e62957f6bd51bd8916dceb53dc5798d5517d
SHA512 38ad97dcd433f3a43a171a429eb85bbf0bbd1ddfa6aa488c74076591f01cdb9b69014f42270cec8512ccd8449c9e0bb140cc264a0c70ddde7c515805b06a0c92
SSDEEP 384:ndiFwtNnNnb9ER38NH8TUNTUlIRJPm3ek32nn9TzO4JfbgG2DT+b1Za6Hwhg2Gl0:UFwjZbI3owgXKekmVSG2DCrDw2lPJEN
TLSH
T1EDD23B36E824CDE7EDEB4F96A31A7653AFE00163D98C1AD4EAC95D1E00871DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a17eb7133de1bd892c32ae0362738c05c95b6fd3df25d6b78612182f7cd3ef10
MD5 d58733cb552e6cb0a8e424f8668873c3
SHA1 c90efed95188a97c5d28b53313349207f40533e0
SHA512 3bc668623091f629d8d4426fb83665e025d5d0593cab4217883db74f244f850301915f635783a536ecfbdf23733be4730a993bbf94d2a7470f218842c038b552
TLSH
T1CE513EE05C785AD1D4BD0E6FB08B34FC81DCC726F5A0347E6C68EA984A7961E648583F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_46878442\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_623101022\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_623101022\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5292-172-0x000002B0CBEF0000-0x000002B0CCEF0000-memory.dmp

Download