788d0aa5714debf87160caecfbbc6cf0f6a78a73bc24471423784e0faf16f057

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 1KB
Sample260527-phpr9sdt5m
SHA256 788d0aa5714debf87160caecfbbc6cf0f6a78a73bc24471423784e0faf16f057
MD5 d4d77bff234513d649bf45ae6b1380e5
SHA1 61e792cddb4935b02fa1749f26e0fbdd5e375c13
SHA512 34de4a50486689ebe013676a057e62819c16df8d4687b2a437c3c39f43fcb27f5f92f74724843b6e619cf11e5be9c89e37339852c6aa29de272ec6c322ea9350
TLSH
T13021EA372A070927D6455E9F7706FBC09D82A8C9A2FD266C705751CFC4CA2B98B9C3C8
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_167446574\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_167446574\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_152859167\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1662166672\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1662166672\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_152859167\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_152859167\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_152859167\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_152859167\_platform_specific\win_x64\widevinecdm.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2064	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243582046728291"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{7E8D4570-D8BE-4B96-A444-72D7CC903B01}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3624	2360	msedge.exe	79
PID 2360 wrote to memory of 1488	2360	msedge.exe	81
PID 2360 wrote to memory of 2064	2360	msedge.exe	82
PID 2360 wrote to memory of 1488	2360	msedge.exe	81
PID 2360 wrote to memory of 1488	2360	msedge.exe	81
PID 2360 wrote to memory of 4496	2360	msedge.exe	83
PID 2360 wrote to memory of 4496	2360	msedge.exe	83
PID 2360 wrote to memory of 432	2360	msedge.exe	84
PID 2360 wrote to memory of 432	2360	msedge.exe	84
PID 2360 wrote to memory of 4652	2360	msedge.exe	85
PID 2360 wrote to memory of 432	2360	msedge.exe	84
PID 2360 wrote to memory of 4652	2360	msedge.exe	85
PID 2360 wrote to memory of 4652	2360	msedge.exe	85
PID 2360 wrote to memory of 1556	2360	msedge.exe	87
PID 2360 wrote to memory of 1556	2360	msedge.exe	87
PID 2360 wrote to memory of 492	2360	msedge.exe	88
PID 2360 wrote to memory of 492	2360	msedge.exe	88
PID 2360 wrote to memory of 5888	2360	msedge.exe	90
PID 2360 wrote to memory of 3376	2360	msedge.exe	91
PID 5888 wrote to memory of 4872	5888	msedge.exe	92
PID 2360 wrote to memory of 5800	2360	msedge.exe	95
PID 2360 wrote to memory of 4396	2360	msedge.exe	96
PID 2360 wrote to memory of 940	2360	msedge.exe	97
PID 2360 wrote to memory of 3452	2360	msedge.exe	98
PID 2360 wrote to memory of 3452	2360	msedge.exe	98
PID 2360 wrote to memory of 2052	2360	msedge.exe	101
PID 2360 wrote to memory of 2052	2360	msedge.exe	101
PID 2360 wrote to memory of 5176	2360	msedge.exe	102
PID 2360 wrote to memory of 5176	2360	msedge.exe	102
PID 2360 wrote to memory of 5664	2360	msedge.exe	103
PID 2360 wrote to memory of 3024	2360	msedge.exe	104
PID 2360 wrote to memory of 3024	2360	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff92cccc188,0x7ff92cccc194,0x7ff92cccc1a0
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,17546857858519111002,4529574783418454895,262144 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,16914349682498125146,12285074403439116660,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,1565990732821881405,2448397389812466836,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,4734779404616371446,11996593953868748049,2097152 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,1080866463104104333,14780527191015530839,2097152 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,8261991561011585535,12809756194329024314,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,15439437940858506303,10694976411240370779,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,3800783916352512698,1595333069985998593,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,6497285856968254328,4197437449638537066,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,3800783916352512698,1595333069985998593,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,4716162874077620541,1044293036636495340,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,14558599677101692302,16446388209996141911,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12459848319111785732,15518173196860806868,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11767194875542692606,10824942885679595421,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,16763362755628208782,13489850969241165192,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,15148371069761759252,6069904467236454839,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5696,i,14939990217725947321,6449084259972070175,262144 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1352017779369318749,15204889230406507276,524288 --field-trial-handle=2636,i,8705240033053418485,9172279377506351033,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e73ed8bb6eeca183b27ce2c0e66202fc6b6c9f615a7425bf3b798e4ae3cc17ee
MD5 69a878f7aa56566f175800f0347b1038
SHA1 2b5e382c6c00c700bc16b8610b90e6dca811f14d
SHA512 09fce31bafaf803771fa0866b602df9ab3b395009f71743e411a44c980faaab7bcc7bb6e4aba900f4c62bf3edfc90f566db4fffe2f99074ce14a30a37cc44ff2
TLSH
T1B2F0F9AAD921EC3718FD1B1971A9074AE75013572780885B3B3D460D4FF573B4785C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ef93b833cae5d985ad5fe9ada9fe5e90c13287e27aa76dc24230de8b3e377c3f
MD5 b5d2f30c4227af730c53125d264ccee8
SHA1 01dc59f0378b03e0856a92da6b6ffef5ae9c3957
SHA512 97789201b412c3c9b0eca3629413ca767ed41c0475a174a568da5a664e3ad70c2f4e8789d21a613017accb8e353420c3607467896079c529c70d6d940e88d49a
TLSH
T198418DF3C3E8856DC91195F0BB287E2BCE2D0A14432C3D5A89E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ecb11c60b77621a05fe04db7f948a99c52a769ba85e5c5b002f45b3da88f542a
MD5 465d06d380ec3dc16d01ffc35d2dbbe7
SHA1 a10f81131ef308f78c9de3e05338805ec1ed023e
SHA512 109c29ed4a00789e110486c98aac922064faa124d20e54be441e75841af4e6d798d3a8b9fd4b21be96996a88a1e3ef6a55b17eb084c0e78f946efb0eca953b56
SSDEEP 384:sxZxsDds/fWs8zmp60Ly8m5/bG5jUjeF9:spsZs/fJA08/bG5Lv
TLSH
T12662F806AA34597B8CDBD319FA45BF53D7F9156392540E44AAFCCB0C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 433b43d03eb0e99c5f9f6a34eb7a6d52a9c3c61ac3c09a3e6f65d60b5fbf6d8a
MD5 915ee74f92093369a0357ac44989bff3
SHA1 5e95391125b525003240019c7010b2bee5e05cc5
SHA512 797ca573bf9253c274dbe364ce21c42729c386350423a711349fe61c869ed4736d1e086b517eee351afe5fb10b53f09434d8597d23518e59b31d06e97f77b285
SSDEEP 192:sxZxReMyMqZjK1Ml8UQzFs/fWs1Z8gE0CXUyynDTxzodpEs/W6+WNGY0d7WoVIge:sxZxsDqps/fWs1mf0Ly8m5/bG5UUxda
TLSH
T15572F816AA34597B8CDBD319FA45BF53D7F9156292540E44AAFC8B0C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1d2c190df290fb0afefe572e682e709d98e6ba9cc99b121a88760161a4fdb9b8
MD5 7f59602d5d0232fcb5faa3973e7a2c5d
SHA1 20667e32bcabf961d2a16375a995c3152323cf5a
SHA512 63018cfbf018cfaca93111d85caacd42740221c730354dc45bc2cb9aaaace7f4524b489567c2ef63cb8297c83a9d9dcd963d596a8e7a678db7778fce73f9212e
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV383pQLli:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK83pJ
TLSH
T130030B3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2bd1d6ccd747bca046824f2436d2f4e5527d93c8e58ba4962f48ed9c9f2a45a7
MD5 17821dc5b9756fef6b993363959a515f
SHA1 b7306026daa20e0975d6d1afa8def4bbb7c8f395
SHA512 e1f2046a752f36700c963986eadeb6912b455033c9d83761038ef0669a5aeaa7de495c8ed0f0aeb20fa64fcc557c4b07a8af85382b63ffc948a0a249dba206db
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ODb:AFBHhTofhno2mB21q3Llbfe3sLDdeEpc
TLSH
T1B0B27D56717B12023C3E291CA7929B370E4272A3345CA56F7BB900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4f24d2c501bd6e3e7765dcf587ed1c1256419bc6c6e7308e9883fcfec31a852e
MD5 4754ac7e44c6e13f25d34c0a813d6f26
SHA1 9805192a3b7a83b1618461fcae4166f36ec09b13
SHA512 02fcf38f95c29d28e0f03f624b9613041c405ccdcc91a0527e31fdab1a9d32ee4cbee40821eebb2dcd435500b2d5432f48a8d0e27f7b923db2cc008a5336236d
SSDEEP 384:ngiF2tNnNnb9Qo38NH8TUNTUlIRQ0yWpPjkpfb7ofalgAYSJSCUSbQmXEGc7maXq:7F2jZbX3YwgD4JofatRSCUSbQAEGcC9X
TLSH
T1B3F2B3F194E799B7D99E5B97A33E6E029ABCC193B4885980F7C80D0DCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 757d129f5a20021dfe3d3ed75f28bb233f6ecbde094d9c719ba3283af89cf864
MD5 2e5c6c9624d9885dc02ef1c752c204ad
SHA1 02d70117fbe6b810d636edd7a02cfb809cca23d8
SHA512 504fcab3270bd4295e8906be6e721fb27bf75e504b7da5c1b24c223ba179cf12ea95d0c4c83cd6ba9075ad522822ee57decf13889d10721a97d81478edb17028
SSDEEP 384:n5fiF9CcmyWCs38NP8TUNTUlIxBydvnoNajkpfb7ofalgAqYOhkP+lFYS/TsHy/9:wFccps3AwgmG7JofatqNhkoFYS/F
TLSH
T13BC24A32ECA9C9F7ECEB4F99E74A7A02EEE01163859C59D4DAC81D4D00CB19D570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 82815af46d38a1af6f0de3a09399845728463be0cfcf4b512c8ed37b3ab81340
MD5 95dc7720d823f2c4e2a153a9ce96b614
SHA1 be6918cd5073ae12df28e0ca4a84bdab40229eed
SHA512 caa5e09d5ed036c0b2ed2dff6dbb24682be572378acdf0bb30a7ce4cae7bd6e35451832ad40a943f595b41b972ccb63a7c6ec48b5cbfc8bbe0553af6fe205f58
SSDEEP 384:n5wiF2tNnNnb9m38NH8TUNTUlIRQ0yWFPjkpfb7ofalgAYSJQCUSbQmXEGc7maXq:FF2jZb83Ywg/4JofatRQCUSbQAEGcC9X
TLSH
T1A9D23A329865DAEBEDE75F99A70E7A03EFE40297858C59D4DAC84E0D00CB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b5c4937aaa30795139672261bd2889aba53f75eef683265268efefb216fe40aa
MD5 fe398265ae425a13175d1889958a0f94
SHA1 55f063f15704a1dd03538d68fc260c4749218af2
SHA512 5370057c78fad49c1b198640ccc4ace7a8dccf901e29a7e52a2935cb65c037f3041eb8d7125437dbd42fdd9bfecddf485dcbad5e5f4201bf1c04c786da3eb584
SSDEEP 384:n5wiF9CcmyWCY38NH8TUNTUlIR2yTFPjkpfb7ofalgAYSJQCUSbQmXEGc7maXHy+:FFccpY3YwgD4JofatRQCUSbQAEGcCs
TLSH
T191D24A32E8649EEBEDEA1F99A70E7A03DEE4119385CC99D4DAC94E0D00CB19D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1633ee30d2458a1bf8063865c666e4a8c18f3a64c0e6a08183ba832226979e8b
MD5 13f41cacdddc8dea3b88d6323b9a921c
SHA1 9a7bd399fe3ea606f044d317e68653efe6c850c0
SHA512 cef6bc2b2eb2044fd8531db80a74fbf3ed3c47e1b00eaf4d60e6d6e2bf662829f1ab4179f8cd38e6d3c8f68c12f886b4418bc20ae57c6d8428c4a917eeff584d
SSDEEP 384:nAiF2tNnNnb9m38NH8TUNTUlIRQ0yWFPjkpfb7ofalgAYSJQCUSbQmXEGc7maXHK:bF2jZb83Ywg/4JofatRQCUSbQAEGcC9X
TLSH
T140D23B329865DEEBEDE75F99A70E7A03EFE40297858C59D4DAC84E0D00CB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.26.1\typosquatting_list.pb
Size 447KB
SHA256 ad756d39f4fa4a70bee09929f53e29bdacbe552aa1d097309b849ccb92ef7a7c
MD5 c1229bb6439d3426ef7e54fa3911e9f7
SHA1 8623ef46acbf1e0f75a298c098800d1012f347c8
SHA512 d1be2ec8c1137138e38d616ee405172bac5cc61e7beecf6d3da2437adab44d8d702df300d84350020e5e9525220193c6015fc58f41a59fb9a9d4fd094e6730b7
SSDEEP 3072:ZOwNK6ZgDoFVUqY7O3Uw4pQXuDlalIfT1JCuGSrw5mWDecdCs:nNBgDoFuY4ioTCTS05mgdCs
TLSH
T15CA4A3B9DFC00154DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77e70e8b8743a25be5c59f81e522c4ff36a644045bc2ac516b55c20d92ebe356
MD5 c4b0d590ee04da586d12ebc5feb88ba6
SHA1 33e3f5b81fd46087b3774706cadb29c7f2f0d216
SHA512 8f84250c6ca92a38693bcf3125eac4f7ac8a7492e09f3424d24e14dda3b42348d897f9fbe6b93c5b4a0e4a889dca7822dcc924dc6a332f0e796240e7989fc3bd
TLSH
T1BB5160E05C7C2AC1D0BE0E6FA48B38FC82ECC325F4A4357D6818EA88097921D748083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8542b62ad5ee53fe3400ce546964abb0af780b6dc7647840b1eb2db4c1756060
MD5 b8450159d9042c16c6665a9cc3539d3c
SHA1 d53f99f1927ff44573ecd8deb4255e128ba5902c
SHA512 d156ffa7066ea05b19cd89035d2db61a363d24eb19e28a9e3d078c1b7618911ad2c3668ce46cd778db537bd0149d0117377e14ab50dc537cc3ab9997619944ad
TLSH
T1F75142E15C7C1AC1D0BE0E6E658738FC81ECC325F4A4347D6858EAC90A7A65D648087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 07fdb31c818157e02d1fb6aedfa45256aa1ba7a729c9042f228f4500bd06c87e
MD5 e0cb3390a2ddc99cf48349c5ea9ef176
SHA1 9b9828197f0aa572b97a5afd5a7b62c5954723e5
SHA512 143a445d536b61640ed810afa85f89029467611aeef64e7dc7fac075acbda4b778ec24b6e88b4dd322487ac5eb46c7b6f3cfc96cbea7851e122149b7d27dcc46
TLSH
T1CC5151E15C7C1AC0D0BE0E6E649738FC81ECC325F8A4347D6848EAC9097965D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_152859167\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_1662166672\manifest.json
Size 118B
SHA256 828658147aa137be854d8e5a079884dd0388f2b7c17400952338374ca0b53f4f
MD5 a9e80c400101025da0ff7fa3616810a5
SHA1 bd3f73166085a1d83452e87dba88ae9058842f4e
SHA512 d1e62ad4c3031173bebb6c8059c84d220a1dcbf993bff7db9ea6680cde90639571d9e57b0e1fc1d3b0c9b024a9027d551532ea28d10c14fc06fabe8a721d34f3
TLSH
T128B092B00C0AA47B22849720ECA06A8383F80218F8065B1E088036881F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_167446574\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2360_167446574\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download