43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.40/editor/index.html
Size 164KB
Sample260524-tbbz2sds91
SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
MD5 b33eb96a570d0cdf6ded11ff199d0de3
SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
TLSH
T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6012	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com
24	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_301472401\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_1836392376\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_1836392376\well_known_domains.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_529693749\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_529693749\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_301472401\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241115775298328"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{F35EC195-5FE3-41BD-A2DD-2AB9DDD1F536}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe
6012	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 1088	6012	msedge.exe	80
PID 6012 wrote to memory of 5268	6012	msedge.exe	81
PID 6012 wrote to memory of 5864	6012	msedge.exe	82
PID 6012 wrote to memory of 5464	6012	msedge.exe	83
PID 6012 wrote to memory of 5864	6012	msedge.exe	82
PID 6012 wrote to memory of 5864	6012	msedge.exe	82
PID 6012 wrote to memory of 5464	6012	msedge.exe	83
PID 6012 wrote to memory of 2216	6012	msedge.exe	85
PID 6012 wrote to memory of 2216	6012	msedge.exe	85
PID 6012 wrote to memory of 2216	6012	msedge.exe	85
PID 6012 wrote to memory of 3676	6012	msedge.exe	86
PID 6012 wrote to memory of 3676	6012	msedge.exe	86
PID 6012 wrote to memory of 3676	6012	msedge.exe	86
PID 6012 wrote to memory of 3644	6012	msedge.exe	88
PID 6012 wrote to memory of 5532	6012	msedge.exe	89
PID 6012 wrote to memory of 3644	6012	msedge.exe	88
PID 6012 wrote to memory of 5532	6012	msedge.exe	89
PID 6012 wrote to memory of 2296	6012	msedge.exe	90
PID 6012 wrote to memory of 2840	6012	msedge.exe	92
PID 2296 wrote to memory of 5124	2296	msedge.exe	93
PID 6012 wrote to memory of 3416	6012	msedge.exe	96
PID 6012 wrote to memory of 3120	6012	msedge.exe	97
PID 6012 wrote to memory of 3748	6012	msedge.exe	98
PID 6012 wrote to memory of 1432	6012	msedge.exe	99
PID 6012 wrote to memory of 1432	6012	msedge.exe	99
PID 6012 wrote to memory of 3372	6012	msedge.exe	102
PID 6012 wrote to memory of 3372	6012	msedge.exe	102
PID 6012 wrote to memory of 4640	6012	msedge.exe	103
PID 6012 wrote to memory of 4640	6012	msedge.exe	103
PID 6012 wrote to memory of 3612	6012	msedge.exe	104
PID 6012 wrote to memory of 492	6012	msedge.exe	105
PID 6012 wrote to memory of 492	6012	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\editor\index.html
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffcfc8ac188,0x7ffcfc8ac194,0x7ffcfc8ac1a0
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,5350049659123933357,10132821964248719331,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,18242225106398897794,3113195952177113848,262144 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,6285583817056462548,8076367470985349131,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:13
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6549823074955194661,9937167720303883811,2097152 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,2086573135864092317,107298982179062928,2097152 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,10316645072852631112,1723998002989073443,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,2051277899379496834,13175498170349560371,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10877900394202333654,4739968959286926703,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3027768637970110663,8752086824911199697,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3027768637970110663,8752086824911199697,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6410431567216174554,4425931645143921260,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,18199943565416795117,14777563027959070233,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,1050776551184920184,17731420399126051994,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,7600681908625229633,12960575692674089653,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,12317821022317907464,16701107567491899363,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,1105942811340311719,17185670011950261243,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5876,i,3601396446294349939,1531624561737719255,262144 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,8189260172267910886,608359898628678925,524288 --field-trial-handle=2244,i,14496891028889830496,16489811546582647375,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 259a768f95ce1f2842fd703a2c72b86e7c5e030dc36df32c4e91e63f04ca7ecd
MD5 c26d4a53789a3503d07a3b26c324ed4e
SHA1 845480e31ca2ff1984af855b95a76b73dd94fb23
SHA512 c5b649d98b65b4cca56f6cc297c8c9898a5d8141b098d75f840513178d4a286f819a97991142c59d483d111cc2a659ee3d3b42afea6b7172d78afa1f1f2a3462
TLSH
T1F0F0F9A6C921AC3708FD1B1960645746E74513AB2B51494B3A3DC20D8FB163B4645C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ec8295549a6fccdae5ada65c9461a4e086058d2f05001432aca8e94f7cedee9f
MD5 4bce5cc2f1a0ddb0b3806f720d0c0245
SHA1 f4244274a1ca228e9d31ca022f2f1e7820d5faf5
SHA512 a64d00aafc296e19213cb2e01c0bc23f148fded64d34544955992aa778a14c682ee2cf7fed0834e7ce17f3763e45a96f7fac3e67a3fe36b27496050c82a5fb31
TLSH
T18E41CFF383E8866D8A0195F0AA18BE2FCE2D0914432C3D9AC9E4AF1BA3E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 03ea57d80641bea581bd9266f11ca3f187a52a6bbf2c69095f4477048dd97e12
MD5 a5fb3f912a336b7e384623bda7bf5873
SHA1 041d6c9c50f01be2a89dcef3a9d8ebc1ddddc449
SHA512 36947a482cbbbec95f15af1764b1cba81a713cb5fc958c28c47fff48de36d7423e3a79fafae128032e3c9186644c6547b0ed7906011d823d2f83c223fd0ba037
SSDEEP 192:sxZyRwyMqZjK1Ml8MFT/f6sOIS81KTG5GN2PdwJzodpEC/W6+WNGY0ht6liIgj+7:sxZyNdT/f6spS0Uei2Ppr/bG5yEj+7
TLSH
T15E6209066A68497BCCD7D319FA55BF53D6F9157291904E44AAFCCB0C05E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d87138ce29333708c4b5a2e61a0f9d10cd68d86f7cbda71480af43e09406097a
MD5 3b35ee13441e030f4d6c8906757f516e
SHA1 60e49896bdc123f8ae564c98da60cb310f3275aa
SHA512 2151246562ee082ebd79275943449987e62267fc33ccf73fb62c81b86c68304ba89a28b7697cbe7ecefb9503f39699476cec0318228d388b1f06dbcc56369112
SSDEEP 384:sxZyNqET/f6sUSuTUei2Ppr/bG5tEEsHyY:sK8ET/fJuTUm/bG5Z0
TLSH
T1A772F9066A78497BCCDBD31AFA557B53D7F9157291900E44AAFCCB1C05E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 9078f9aec77c5f4721e212f6b45f3699b2d694ec4e13717501cebba4db201dfd
MD5 12bf142c15664f07329473005b487791
SHA1 a3461fb91973814c252cceaafb8b75ade7a52b51
SHA512 f348963f3c936a07b6703a4dfcbac506f195eeda12e405e8238e3a3d6c983ad25a5b78e510ffcdc51c3f9dc66e935ad30a7edc213f205173364c43419732cbf6
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mzx4LlZ:wQAKq8y02yqEnjbWRmj1QWTu1jaKmzxC
TLSH
T1BD03FA3B680CCB7E4FC04E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 fe551d34186382beb36ee7b3db7e92be056588c62d9f4bee3c2f9f1f4fa20c40
MD5 aeb5dfbe3f7101030ea91fed714afdf6
SHA1 9e1eb198540f67a42383fb34cab2c7f1aa2746ec
SHA512 47026690ebd7b130a744f45aa50202f7ee7982fbbfbbcbbfac5b0db1971e941358f1fbf6da79d2b5d2faef71fac793ed30b4e3b68a1567b0174596e0802413b6
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5u:GZLVDJjEDPV0/Zd45X
TLSH
T185A2495232FA02423C7E391C929687674A42F2633459ED3F7BA940B54E27E225DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 df79a5f2d4cf1fefcd4a0c79d715c12b655d73771738249a395c3edea522b75d
MD5 dba9fb58b34bba6c51a1c22f24eaba8b
SHA1 1dfe1d30d1eef55bdd89d443d1a286f15759224c
SHA512 a4200d10c56c7d29eaa94b9973a27ae823567012820484ab5b3639fb5bc0e4f17cf499756d29cb96dc561e672964b97ca886998c80450a690052eccc5ff0f89b
SSDEEP 384:nNiFUtNnNnb9v38NwZ8TUNTUlIRKPm3ek32nn9YXaMSSfC8GiGUWOraTfVo9dYkd:EFUjZb13RwgEKekmofG6W1fsYkPjiY
TLSH
T1DBE2B4F598E78977D9AE4B87A33D6E029ABCC15375881994FBC81D0DCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9efbac52f4d44fe977032de5829cea490f8fe7272ff23519182467159979e343
MD5 3e863fffc49c686744f15a81a2354a0d
SHA1 014eee7b1d4429749d8a39ae0e8fc7adf1b42a43
SHA512 f29d89f2ee7ea9608a1b4c1be3b8bd834adec3289c311c76b7788ce664e266a16d3772ff7616035a52712d169c9f7714f1e7e6db173132c5741bf7974a714600
SSDEEP 384:nEiF9CcmyWCs38Nq8TUNTUlIxBPm3ek32nn9B7QtsSSfC8GiGUWO7be4KV8p0fYP:fFccps35wgPKekmzm0G6WGbI8p0wP
TLSH
T1B1B25B35EC98CABBECE74F99FB0E6603DEE05267869C49E4DAD81D0D009719D134B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ae14c0539d8e1e199d6cd3628909b1facb095e0ded4844ab69197e329fa604b8
MD5 752733544fafc173e13a10b2ad3ee657
SHA1 996704d5a6dd299f711a8bb3cdfa53ea9cf5ed6c
SHA512 1ef39d6516ebec01eedf787b82aec1c782771c3673c29cd27f182cf0c9cba588bd6b854f44e824180c2e2e8f06b5043ec6f2cff8ad0570f3f00263a8219362b7
SSDEEP 384:nXiFUtNnNnb9B38NwZ8TUNTUlIRKPm3ek32nn9YjaMSSfC8GiGUWOraufVo9dYkd:SFUjZb33RwgEKekm0fG6WUfsYkPjiY
TLSH
T11AD24B36A868CAABEEE78F96B71E7643EFE001A7958C1DD4DDD81D5D018718D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ea2260b7a4188552231bba0c18559f107b99696c631b72283df62d0fb0686da9
MD5 baf520bdb29bd1137f338bf46cefbdff
SHA1 313b917a9acda5e450a519baebd940167c9734b0
SHA512 f2eef781879a6ea6709f6e5a19110c2441baed4d8a178d02085f16c2c506a3de62d8c105d464dcb278bed1722428069f8da95a864acac6fb751283b3da86fff0
SSDEEP 384:nXiF1tNnNnb9h38NwZ8TUNTUlIR+Pm3ek32nn9hbjaMSSfC8GiGUWOraufVo9dYi:SF1jZbb3RwgEKekmXfG6WUfsYkPjiY
TLSH
T14CD24B36A868C9ABEEE78F96B70E7643EFE001A7858C19D4DDD81E5D018718D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5437d64dc303a9ea9d98b8afb69c19290f2adb2a8c6959e91f1f9f7aa787825e
MD5 773a130a723de7739faeaf8734e43910
SHA1 9b6421e4182f9493c505b46f7cdb73305bb535f5
SHA512 1dd5603e350a84aa3df61a00b7c8d7dae634743bd3a2ecfcc0f2ff3a22d5ea65686f1834fc8d7a09d7874104435aa82c3eac9ffe055bf4761cbf7f1eed5b489d
SSDEEP 384:n8iFUtNnNnb9B38NwZ8TUNTUlIRKPm3ek32nn9YjaMSSfC8GiGUWOraufVo9dYkd:nFUjZb33RwgEKekm0fG6WUfsYkPjiY
TLSH
T11CD24B36A868CAABEEE78F96B71E7643EFE001A7958C1DD4DDD81D5D018718D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 980f045091723e67c931a0b4eceadde322bcd203daf692e81716f83921a23f37
MD5 62d77a08bc4141b5f85ec409f3b7f565
SHA1 91bd600f0c67966190a745a47c6af5fbf9cf9394
SHA512 5fa3c0821103f3e9d297b2c642e143373d7013f0b80ea3c3b53f24d964d5f63180fd201a253972d722319236ea34b4c9fef356ceb53ad1d5dabdca3bcf6e70c5
TLSH
T172411EE1587C1AD1D4BE0EBFA48B34FC84D8C326F5A8707D6C58ED984639A1E294083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7ba017eb04ac9706f2fa7962204d2ec635366031d074939ef699fda495131328
MD5 643609dedb4ad2873e44fa3842830503
SHA1 e97c8dab66b731ec94a28f5fc56006a87e020dfb
SHA512 99dd8af514c809c59db717300c88e8240abc1b4205e53163d0260f6ff14cbe02421b2db5649e0d20f0023db454e0eb499ab5fbffe60662e3958edb5256b47b08
TLSH
T1804122E15D7C1AD1D0BE0EBFB49B38FC84D8C326F5A8307D6858E998467960D658183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b69671daad9a7ab9bc27a888fb612e3c2ee8feb0e0607d650b2e12c1857a8c5a
MD5 302e925447de3c0c6d9154c423018714
SHA1 95df6361a6e29f233711813bba0fad14726187c4
SHA512 02da99b66642cfe36479cde30bc314c409b2c065fcabe6d17e24bd3bebeeb6d00e84aea7263f7df6d18e62da3f9bd1f816f265dc84811ddbe67286b06bc009eb
TLSH
T1174111E19D7D1AC1D0BE0DBFB49B34FC84D8C326F5A830796858ED58463961E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_1836392376\manifest.json
Size 141B
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35
TLSH
T134C04C5185005D72509D87781D6C97054B12CF4618947509DDC68309EC1DCCB64B234E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_301472401\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_529693749\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_529693749\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download