68030a6f628f860115432c4ab704d8a8cd6b7a511b09c63f1c0c59e35c38a00d

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.htm
Size 1KB
Sample260529-xmd6bsfs2k
SHA256 68030a6f628f860115432c4ab704d8a8cd6b7a511b09c63f1c0c59e35c38a00d
MD5 5d333847ea3381ede70b2e44ee020416
SHA1 ac04265c3e1af4222c417216282ce16a7b63c5a1
SHA512 a0fd61dd88d9961903f53c82adaae503acce8c1ef8e8505a07b0245d629ec8eedc946961bf8ae6d9f631f2f9ef950a7cda8ab697c2102451807185d7d4c23bec
TLSH
T11941505FEB909B1FC0331BAC446614E69B79866315BF436A34AF56130B21289C753CDE
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1572211581\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1572211581\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\shopping_fre.html	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1980700457\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1980700457\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3196	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245547065597655"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{DFFD2558-CF8D-4EDA-8DFE-921587D10D18}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5744	msedge.exe
5744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3484	2264	msedge.exe	80
PID 2264 wrote to memory of 3444	2264	msedge.exe	81
PID 2264 wrote to memory of 3196	2264	msedge.exe	82
PID 2264 wrote to memory of 3444	2264	msedge.exe	81
PID 2264 wrote to memory of 3444	2264	msedge.exe	81
PID 2264 wrote to memory of 5008	2264	msedge.exe	83
PID 2264 wrote to memory of 5008	2264	msedge.exe	83
PID 2264 wrote to memory of 3408	2264	msedge.exe	85
PID 2264 wrote to memory of 3408	2264	msedge.exe	85
PID 2264 wrote to memory of 3408	2264	msedge.exe	85
PID 2264 wrote to memory of 5512	2264	msedge.exe	86
PID 2264 wrote to memory of 5512	2264	msedge.exe	86
PID 2264 wrote to memory of 5512	2264	msedge.exe	86
PID 2264 wrote to memory of 4852	2264	msedge.exe	88
PID 2264 wrote to memory of 744	2264	msedge.exe	89
PID 2264 wrote to memory of 4852	2264	msedge.exe	88
PID 2264 wrote to memory of 744	2264	msedge.exe	89
PID 2264 wrote to memory of 5364	2264	msedge.exe	90
PID 2264 wrote to memory of 3628	2264	msedge.exe	92
PID 5364 wrote to memory of 2832	5364	msedge.exe	93
PID 2264 wrote to memory of 5196	2264	msedge.exe	96
PID 2264 wrote to memory of 3168	2264	msedge.exe	97
PID 2264 wrote to memory of 960	2264	msedge.exe	98
PID 2264 wrote to memory of 1416	2264	msedge.exe	99
PID 2264 wrote to memory of 1416	2264	msedge.exe	99
PID 2264 wrote to memory of 4000	2264	msedge.exe	102
PID 2264 wrote to memory of 4000	2264	msedge.exe	102
PID 2264 wrote to memory of 4664	2264	msedge.exe	103
PID 2264 wrote to memory of 4664	2264	msedge.exe	103
PID 2264 wrote to memory of 5744	2264	msedge.exe	104
PID 2264 wrote to memory of 3640	2264	msedge.exe	105
PID 2264 wrote to memory of 3640	2264	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\README.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffcfe6fc188,0x7ffcfe6fc194,0x7ffcfe6fc1a0
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,9541401749594975483,4329057428099029011,262144 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,7806152138640163805,14905299486224200051,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,6797035289064747457,4135742947274116545,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,1161986438254066735,16790503267686714959,2097152 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1367312807125326561,17961797338536986302,2097152 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,5105187026983957507,9505561832697034074,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,18423861703891375949,14849716985516925113,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,1276073031110355965,15902701664999397043,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6559174325883145399,12414921499451296116,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6559174325883145399,12414921499451296116,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,15028092869621866296,10770990437271742335,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,14821297558081219766,10445282417989305523,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8043012584282579382,8016166974083880316,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,15682717056406802770,10069308430781780590,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5249238637390919236,1872657200089418420,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,11143496525476862521,2634726126121730545,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5560,i,13136968182579701710,12017879758514894459,262144 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15837269815017349250,7358134289798839798,524288 --field-trial-handle=2060,i,16659907933339054981,86725335365529482,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

82093ac8-86c3-45d6-a15f-36a89426c0d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82093ac8-86c3-45d6-a15f-36a89426c0d8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7d90483f5cc1a4b705ea07359f8f919c38b064c24f72e649b3506531115205db
MD5 68a17b3c84e14728dced22f39f2fe0ba
SHA1 3c51f948d1d4dce25dbd8eafc4b170d41234c730
SHA512 6f4b079703cbd9b5ff9575bae62ec0c13c46581fc02d234c1c93f0aee22efacef5a1a3d04417e3d3359f58f0bf18b7908de3c6db6ca5095a518a714cc6c0d55b
TLSH
T12E41ADF7C3E8856DCA1196F0BA18AE2BCE2D0954432C3D5AC5E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7c7d948495cf6252777921211cb39dd38c56836e6f5b181ce448e062622033bc
MD5 f791b4023a192158ae5ad88fd8ed25fb
SHA1 56826bb3d9f773b9ea7ccd3beef8a2cb80454e90
SHA512 df407cdbffd7aa14aa80f901c1d93aa4c28737a827b855d50a1e4461654625c3983dd7df2d4b6a522233ac8e5d0aa5587acbf06cf09332e1436aaf8f4b4e379a
SSDEEP 192:sxZhR4yMqZjK1Ml8MFH/fns8N3xE0CXUyynDIzodpEp/W6+WNGY0dg3igIgjeJ:sxZh1dH/fns8N360Ly87E/bG5sjjq
TLSH
T11A62D806AA38997B8CDBD319F6457F53D3F9152292805D44AAFCCB0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 15f04cf198b938901a83220f58116f1013de7540e91702d986b7637fda6ce49a
MD5 90a70fbe6ab7f66d7ec047e0121c8772
SHA1 ae94eb820b5604db261092d59dca86457638bda9
SHA512 8ac34a6f0712fb0e288693e52cab624dafdc19f8c19253e4faf782f8602f4f68d6a64315bda4a57bb7ee18044c4ba8a1a7aa578cd82bea764793cd9dd22f37ed
SSDEEP 192:sxZhR4yMqZjK1Ml8UQGFH/fnsXSE0CXUyynDIzodpEp/W6+WNGY0dC3igIg54lJ2:sxZh1qUH/fnsXd0Ly87E/bG5SjYJ2
TLSH
T1F272E806AA38997B8CDBD319F6457B53D7F9153292805E449AFCCB0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7dfb657c2ea87b7f411bdbb0dbf8c41c814dd7c5a07e705035540ad3f435fd5f
MD5 6f3d5a420130d984300262fd40525d35
SHA1 c60b36beb0a248a0587baeb6b1cd14ad1e566b03
SHA512 a89386747fca4c2951d518a421f7bfa71c4a6fdada3b6d8b8b3033cc88dbf3ee67d4ab8ec010790875b300e37e0921f92f0af7e35e5224204e20b975cf89f91d
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3k3pQLl7:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKk3p8
TLSH
T191030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 14337fc8476d529ab97e9efea87404e0a88766f808760fc225745d141b90462f
MD5 8d1a62037a681bb94b17b15fdd748a1a
SHA1 b03083132e2e01e20fb885ee115ed26f2997aaa7
SHA512 8d63025531a119563bb0e6ee649a507b2363eca6af8282c9e6673410e5288bf441f26692fb08e1e677973d87193fad2b5dbc38bd25f6b36d2e9f78e343828a3f
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ELw:AFBHhTofhno2mB21q3Llbfe3sLDdeEpJ
TLSH
T153B28057717B12423C3D290CA7A19B770E8272A33458A56F7BB800BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a88ea5b4-7c01-49c1-86de-0be8be4a2f53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a88ea5b4-7c01-49c1-86de-0be8be4a2f53.tmp
Size 649B
SHA256 1f30fadaca3d3063588d235ac3909647f7aa6677c9363e626f8d45f260d83a97
MD5 4275b8fccd383f849795f3e89fdf736b
SHA1 952e0e838b424e8b6f77a24a44a1ec479387dc04
SHA512 9776bc681e2e58bc65432e9193a2ff307f27f3c38c42aaa354e9f9f74cedb9fd49d25335adbe3eed747029332d82ca095f7105d5ea1f0b74fc640f3bbe2b9997
TLSH
T12FF0F9BAC930AC2714FD0B1970A5174AE75013672780885B3B3D860C4FB573B469581C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 845c93e6fbc7b5b87c4f9f9c99f4bbbe5bbddcb8b659592cce56813bba46dce1
MD5 5c6c6e9e7346a9813b84e3b355a73a12
SHA1 689529d2d69931b1e8017727cb98232976a0a888
SHA512 d95813e8b5fe3f4aa09025f61aae52d09418a316aeb9d22d172874f7b0eec6df2b39894d7e06761993596bf7dd17d2bb5826de852b3ab140583700d5ff03f436
SSDEEP 384:yLiFPtNnNnb9Z38NN8TUNTUlIRFy3M4ujGfb8o/8mkafBQCdDgBSTK3RlUV4AHyV:jFPjZb/36wgXNoV5fB1gBST+R2WIO
TLSH
T129D23B32EC64DAA7EDE78F99B70A7743EFE80167859859C4DAD84E0E00C729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c19e5701a6c478c8afc78736281fce75af18e1b8843c16cd5735f7d114242654
MD5 07bb877c41b7f9f063017942fd659861
SHA1 d72f3df7d0eb79d1a9930679273ae1513ab165ab
SHA512 77f24966bbc3403d28c1c66e208951f7f1ad3944f99307f4c03470cf494e902220cd2bfed35512a95a2122490eafec50e6a543a9f6d02e6ccba0b60528196620
SSDEEP 384:n5kiF9CcmyWCs38NR8TUNTUlIxBydv3otajGfb8o/8mkafBQCHLhkP+lFYS/1PHA:xFccps3KwgiQOoV5fBjLhkoFYS/6
TLSH
T1B0B25B36EC68CAB7EDE68F89EB4A7603DEE01163C59899D4CAD81E4D00CB1DD1707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 14f2877de344d0605e68aa35c8b3528a98f7d7c263c6338bbaa5863be87a23d2
MD5 4aeebfdb7405f0ea8ee45b957d9110ce
SHA1 4a03276a3396739b51068b469f13c0e2f78e36f8
SHA512 f36eb2c13890efcc9aacdb636630c96cda03dc5f1b8894292f8ec4d91ef18c63676c1633e2802c702667ccb2f51f02e57506cf2f83a0b6c0a55d5aee2b8c6da1
SSDEEP 384:y5DiF9CcmyWCa38NN8TUNTUlIRPyXM4ujGfb8o/8mkafBQCd4ghkP+lFYS/1PHyu:1Fccpa36wgpNoV5fBSghkoFYS/v
TLSH
T188C25B36E868CAB7EDE69F89F74A7A43DEE40163C58849D4CAD90E5D00CB1DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6e410b1bb691cf671938e180c3bbf4714e3eed662bf94f07a20cd8435d38a695
MD5 18ac38bd90ac333dcdacb14301ffbe68
SHA1 a9a0b3305f5857aa2cef24703a3bec17b6becf63
SHA512 8a34be048e57e2f6d91a37ea786074b949d20a518c8d0f3f967996bc39b0fe6198754a96cc59d4bbd247614d6df1e53d6e4c3d160d5dd33e87b1fc91f9407ddc
SSDEEP 384:y5DiFPtNnNnb9438NN8TUNTUlIRFy3M4ujGfb8o/8mkafBQCd3gBSTK3RlUV4AHU:1FPjZby36wgXNoV5fBVgBST+R2WIO
TLSH
T130D24B32EC24DAA7EDE78F95B70A7743EFE80167859859C4DAD84E0E00C729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 034b650e9696f357774e5b29b45cf16f1b79b6c164f4928e027a89b3da427375
MD5 f64fb82eeb1262f8f0762ada513a413e
SHA1 16c0ffa8f4a4c289c9f8b305b2849c4709741ab5
SHA512 ba717d98926ea01a1191c5d354912d67330291b169cd95c2e5588d8d13f333fbb2579359ba6dae309c88ce97a1435f62fb289d44c565602d104178870333e4f8
SSDEEP 384:y6iFPtNnNnb9438NN8TUNTUlIRFy3M4ujGfb8o/8mkafBQCd3gBSTK3RlUV4AHyV:cFPjZby36wgXNoV5fBVgBST+R2WIO
TLSH
T1B1D24B32EC24DAA7EDE78F99B70A7743EFE80167959859D4DAD84E0E00C729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 96b5930462ea41ffff9664bc8afbfc3826c4cd6c5bc447156d03d7a31a15eb08
MD5 e176b77b21caf784ec5805de00033ed8
SHA1 144ff20eba5143fabbcc2ca998e0a5b699e02d0f
SHA512 b710807d31adf651a8cbd1a33c764e5ee2be65e82e703a31528d2307c55ec4ed7181bf23ef7ad5f89310af467bcfc2be3abe24aa6e429a408c5a09aea8a9a209
TLSH
T1194141E05C782AC1D1BE0E6E608B38FC81ECC72AF4A4347D6808DED94A7961D658487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 312915e852c0d8a278b9072554e7626d400f794273323aac80a222307cb583a4
MD5 03e1b16d7907124d1cfb59f1a4e62dab
SHA1 4d4dccee3b1ff842add9d12909fc800793fce13f
SHA512 82eaf2cc57c270575640c2509d4cf8a876a1fe724a963f79ad36c6e674e9fc2c5c97ed76c3f9089050e1056c40ca51e316d06174df15b36103c6b7d837c367a2
TLSH
T1994121E15C3826C1D0BE0E6E748B38FC81ECC71AF494307D6858EA98457961D658187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e6b342248cb35dc3d659cca7e87a72ef738dcc48ba17bbb605c32ca705444f10
MD5 3a06232f7326a42ca51bc80cd18167d8
SHA1 c3ed78272afb311edb091143bb8a2fe47624939d
SHA512 867b2a7845798137003e9f61bc46c1d52059c179684b5e071d0416c3bd26aa770b9e82fa1af238a145add79b0f0ee767d1d4cf2c077fd394b8d1a57de81fd618
TLSH
T15B413FE15C3C26C1D0BE0E6FB48B38FCC2E88729F4A4317D6818EA98093920D648187F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1572211581\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1980700457\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1980700457\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_968658922\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3628-156-0x000001BCE9660000-0x000001BCEA660000-memory.dmp

Download