b4056ca07cbe8a3c71d16206c45c9d5515c74912647eb67100390f95a8a88600

Analysis

max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kVRdeOapZJ.html
Size 3KB
Sample260530-dth83sdx2t
SHA256 b4056ca07cbe8a3c71d16206c45c9d5515c74912647eb67100390f95a8a88600
MD5 6770545cf6c477c0dcf0d1dc265560b3
SHA1 72c5fedc211d563f5b8526caf567e30235695bbc
SHA512 d837a826e6d066eb263d698c3ad425bcd72067c080e51de2f1db8d3a7ce5adf81e340f47a516e9326527fea69a8b0b65be5198184e88bd30699ecf320d7ba61f
TLSH
T1767181B3C9ED301BAB94A2C11D6362474A33E753478E9A72B0EC16CE6F46D23D84314C
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1696827400\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1696827400\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1349072970\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1349072970\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1205395013\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1205395013\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6020	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245846856440970"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{512F4403-2FC0-4B23-AB5D-2395F3FBC3AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
400	msedge.exe
400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 5980	3524	msedge.exe	81
PID 3524 wrote to memory of 6020	3524	msedge.exe	82
PID 3524 wrote to memory of 3088	3524	msedge.exe	83
PID 3524 wrote to memory of 1844	3524	msedge.exe	84
PID 3524 wrote to memory of 3088	3524	msedge.exe	83
PID 3524 wrote to memory of 3088	3524	msedge.exe	83
PID 3524 wrote to memory of 1844	3524	msedge.exe	84
PID 3524 wrote to memory of 2280	3524	msedge.exe	86
PID 3524 wrote to memory of 2280	3524	msedge.exe	86
PID 3524 wrote to memory of 872	3524	msedge.exe	87
PID 3524 wrote to memory of 2280	3524	msedge.exe	86
PID 3524 wrote to memory of 872	3524	msedge.exe	87
PID 3524 wrote to memory of 872	3524	msedge.exe	87
PID 3524 wrote to memory of 5836	3524	msedge.exe	89
PID 3524 wrote to memory of 5836	3524	msedge.exe	89
PID 3524 wrote to memory of 2492	3524	msedge.exe	90
PID 3524 wrote to memory of 2492	3524	msedge.exe	90
PID 3524 wrote to memory of 1776	3524	msedge.exe	91
PID 3524 wrote to memory of 5780	3524	msedge.exe	93
PID 1776 wrote to memory of 2912	1776	msedge.exe	94
PID 3524 wrote to memory of 5556	3524	msedge.exe	97
PID 3524 wrote to memory of 2780	3524	msedge.exe	98
PID 3524 wrote to memory of 2476	3524	msedge.exe	99
PID 3524 wrote to memory of 5720	3524	msedge.exe	100
PID 3524 wrote to memory of 5720	3524	msedge.exe	100
PID 3524 wrote to memory of 5188	3524	msedge.exe	103
PID 3524 wrote to memory of 5188	3524	msedge.exe	103
PID 3524 wrote to memory of 5868	3524	msedge.exe	104
PID 3524 wrote to memory of 5868	3524	msedge.exe	104
PID 3524 wrote to memory of 400	3524	msedge.exe	105
PID 3524 wrote to memory of 2352	3524	msedge.exe	106
PID 3524 wrote to memory of 2352	3524	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\kVRdeOapZJ.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x2c4,0x7ff8c13cc188,0x7ff8c13cc194,0x7ff8c13cc1a0
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,17314292396985015714,17708329957948322467,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,8671989396006720894,1741392107150027300,262144 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,13613928462851485021,1094068727684198116,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6277972284009182528,3559853830095858544,2097152 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,13880472332012710143,3093642318537528159,2097152 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,733087179515416517,7417565128505008988,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,12761413105995834017,3277377252816426186,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,12546001618294996107,815929644017459806,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2915499160777436231,18320813725402255472,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2915499160777436231,18320813725402255472,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,3752195673824067921,2220164162556328119,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,14744723064551581571,8378422583665409833,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,16599577746964651895,452690277525720855,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,12140853215965203041,14390340294187815226,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,2967137097939140037,7987072658680304810,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,8238403223048320985,3796429391169380305,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5992,i,16084683467619058107,13862126909309730347,262144 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,16739085309095211398,4941122009410320741,524288 --field-trial-handle=2172,i,9860237374966741668,13495880758897861477,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e5c085890187414b9c57bf1d7c6619d846d8bd0d6fbc1f67f9537c6e21a52631
MD5 450ae115d69b52669b6623b12c5c2b35
SHA1 d7d5fe6d152115fbcac7f962b272c333d1e69a5f
SHA512 5b4bebcb8bb3993384a1b8a0a0c3c71429adc78e2668e9ea656be40ef65878a91a4c2103896b864d2604b9fa6c6092167caae971e8d436e35995f88741375450
TLSH
T187F02DB6CC21AC3B18FD2B1960A85746F745135B2B41494F3B3C820D8FB463B4645D2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9fda5093c0ef18517e51feabe7f3bc275e7b715ec9c0eeffbbc4529ffb29ab03
MD5 5f168cfc24a52c5bf0bd4e9762b685e6
SHA1 11cdbb57caec29ee118e2e3cff84b1648642fe81
SHA512 c03a07f35721c3e982752c60c836e2a43395c152127e3fee1fd28a071a63aaeca6fedfa1fce56db808686f62f0e1ea27b66fdc2fad7f410dec786f3f581db19d
TLSH
T1B541CFF3C3E8856ECA0195F0AB187E2BCE2D0910432C3D9A89E4AF1B93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8f168703103fc3e7bdda507338ba148afdbc51a8c9eeae58b1c62f466b53aa6e
MD5 92f936c9a6e0deada5238ec326b0e2e3
SHA1 5f94e909c5607507915ca20db0a26de6e9962043
SHA512 646990e9a09218a88bf2fe304354e09cd7672e45eab77bd3df89bef248c47ed7ef50c9c27026c16747b71a5f8700d6c214258a3fca2af8c1eb85dc0ab027ddbb
SSDEEP 192:sxZvRhyMqZjK1Ml8MFP/fWs6WhKTG5GN2KwFzodpEG/W6+WNG+K0ht7vyyIgj+BJ:sxZvedP/fWs6WhUei2Yz/bGQzaSj+L
TLSH
T1E262D8066A64597B8CDBD219F6557F53D7F91572A2904E44AAFCCB0C04EAAEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fbea0f8f99f9cadc6f9d1ef6d21be2db653d524040bdae434f81dbe34e8bedba
MD5 74510fb659f684a604fc5ffa13f13b47
SHA1 2f819e8221329d783c452cfd400d2c955d9a98f9
SHA512 085a7521d3529500ba1c8c4d7466754d734f0d2bd5173ab2a774c8e9a14ca9694318756603d4183df7fc7f381e940483dfba3e2816135ce6e9e08c6f608abb60
SSDEEP 192:sxZvRhyMqZjK1Ml8UQ/FP/fWsvWRKTG5GN2KwFzodpEG/W6+WNG+K0ha7vyyIg5i:sxZveq9P/fWsvWRUei2Yz/bGQGaSKFT
TLSH
T18972E9166A74497BCCDBD219F5557B53D7F91572A2504E44AAFCCB0C04EAAEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 413c04813e6febcf5cfbfe02f550ebf579d0b28aefab57a09ae0ea2fbde09df7
MD5 3030dca31c456e1670536953e84ea6b5
SHA1 734f74d79eab64f61c7b8d909eb3d404cc2d6cd9
SHA512 27641ab3dc58c7b123f8d64a698286c5aa6ab729b48b20e9446dbc49b3103f7b6ab2196c463530cdef727ee02298d291048e8c88853cb04f4cb667db8394dc7a
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nzx4Ll3:wQAKq8y02yqEnjbWRmj1QWTu1jaKnzxM
TLSH
T1B303FA3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 07ed0658898079066ec5bc5610fe906ce6e43489f85a0e14132e71e828001764
MD5 fa5e0192ac5b9c9a25101ba616adf0c7
SHA1 cb783f0703646cbf4ed4f5dfd9327a3906733606
SHA512 619fc4a8e9e39d1215629a4f38ab5a7ad1d8e627f790ea343baa7e7668ce6ba72713c669ca1b0a5515f0216a8dff8120c7a246f385e104e62bcd246f91492997
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5v:GZLVDJjEDPV0/ZdArndeh9V
TLSH
T153A2590232BA42423C7D390C93969B674A42F1633469AD7F7BB900B54E27E125EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8ca2ff0a9e5cf0ed24f4f2baf65f40bd6371e9f216cecb050804e62572cbc366
MD5 f656ae6711a6142b4c52edd93548b7d5
SHA1 541ca3d43d3314e948b189c18f36b97b4c5ac440
SHA512 ca5d731956341b663e8197c4353694923e1132d1cda51da24c8e6ffaa333f56213d92ec55a966834b3850c753666781c44a8d0d27fa9f3e7a57500727bb92c66
SSDEEP 384:ydiFUCcmyWCM38Nr8TUNTUlIR/DPm3ek32nn92Xo4uf+8GD4k+LBG/yE8BSTK3R1:ZFfcpM3cwgNKekm2KGu4X8BST+R22KC
TLSH
T133D24A32EC65C9BBE9E74FC9BB0E3A53DEE4016395884AD8DAD81E0D00D719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f19e865556a4ce588dd8a47156ab7aa37744c3939b34ad4e62c52d0a49402f1a
MD5 2f3654ccdd5f972f146706be307bcde6
SHA1 39d2aeb7f47985c20453f022b1fcb6f456de20d3
SHA512 60a35464db548522fda63aae76918cc24d24f4242b428756cfb919c6ab9a19d267cc52810884009c56867a3eacdc52b7fdb008619c0c488e8bb5ee04b76883ec
SSDEEP 384:nWiF9CcmyWCs38Nn8TUNTUlIxBPm3ek32nn9BdQ69s4uf+8GD4k+LBGXde4KV8p9:9Fccps3kwgPKekmlZ+Gu4XdI8p0vm
TLSH
T164B25B32EC58CABBECE64F99F70A7A02DEE4116786984AD8DADC5D1D009719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6536788e60261e767a6ba338cadc89180051819b87f4d2993addd4c449220544
MD5 817b50a10f418dded8068bc65b39bc48
SHA1 4bb6a4022f5f6a1160f34804106b380c37e233c1
SHA512 36c09d5af9bf8079dd0ca5e3ea858f0d7d886c4727ea8ce32742064302df862e58613402d251dbdbc8a70c269a8c2871727b144252cc04833f8fbdb40becf59c
SSDEEP 384:ygiFUCcmyWC338Nr8TUNTUlIR/DPm3ek32nn92Xo4uf+8GD4k+LBG/yy8BSTK3R1:KFfcp33cwgNKekm2KGu4/8BST+R22KC
TLSH
T11AD24A32EC65D9BBEDE64FC9BB0E3A53DEE4016395884AD8DAD81E0D009719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 99f40eaa88cc4e29be12afd4af6cb47ddf3c8c1332bc1ded1e0109ee44d39ae5
MD5 c013b1899711b3a3c63a80f42ab97c94
SHA1 cc1a1bbcd41d2250621a1ec9623ae5454654865f
SHA512 4f305558ec2865455ef86f5c1805078e89bbea6fc4207f51ac82b5eba37cba7d15c6b0670ee2adc1abbf65878503876776df636acbb50d08c00ca0c99c50df6b
SSDEEP 384:ygiF9CcmyWC238Nr8TUNTUlIRbDPm3ek32nn9yXo4uf+8GD4k+LBG/yy8BSTK3R1:KFccp23cwgNKekm6KGu4/8BST+R22KC
TLSH
T165D25B32EC65C9BBEDE64FD9BB0E3A13DEE4416395884AD8DAD81E0D00971DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cd61c850fc7baece76e6815dd2074a13d7c2a54fdc4f71b691f67db03853853a
MD5 990262831c591b85efce371615fef81d
SHA1 4292e38e6a3997e6a6a975a5688fc9eee6a97051
SHA512 211fd9b3342038d0c7036c6deee59d44e54dba3b0f4ef62e9de27214e3017ae6e1314b1bcf770d60da32e606a7d85ec94ed71c58fc8e7f83521fc9f4076fb198
SSDEEP 384:y6iFUCcmyWC338Nr8TUNTUlIR/DPm3ek32nn92Xo4uf+8GD4k+LBG/yy8BSTK3R1:EFfcp33cwgNKekm2KGu4/8BST+R22KC
TLSH
T1C0D24A32EC65D9BBEDE74FC9BB0E3A53DEE4016395884AD8DAD81E0D009719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ecd462427eedd624deb999cad5ccaf970339807d92a94851e1d72f4d5bccad3a
MD5 839bcdbc313b193cfa84bc2a1e1aa561
SHA1 aec0345e6055358db00d5933836f0f4355adf657
SHA512 8423187aaf58004a0410b75e1ef0c275075a8b01ce182c2cdcf9b6b93f8fd2279a8d688b5dab1b15347e19a8854815b73f7ba8aacef8b79d8c56f1a0661337eb
TLSH
T1034141E15C3D2AD1D0BE0EAFB49B34FC81D8D326F5A4707D6858E998467D60E644183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a10579ddb5e5783592b5cd07fc32fbad085fbfed4ebb5e5efcc579807df7c8ff
MD5 56d05eb6ba3537ad1d83dfd11867539a
SHA1 4fa53cb1c99efe575c2a4218ac030e325543e4a2
SHA512 54f18ece417130ab8c2a15fccd6e414dbb40adfb4f0b6e7f531558a0cd309336c9e9de28f548e11821019bed68969645ad1446bc2390775d8435a19d46151faf
TLSH
T10F4120E15C781AD1E0BE0A7EB09B38FC85DCC726F5A430BE2C58EA98467965D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b2713b53b35381cf2e8b4a19af3b802028dc2360e983e1aee60f4d5c32358dca
MD5 ac01b90369d255a7750c4e2d2c539847
SHA1 0dc70aeb281c3c264aaa2d63b8348dc6202d368d
SHA512 77114b0f7b45c8b6a51250ea06a9a05c3d9c1ef1816f3217bfeeb3051db589434763e4f06286787ec0b9e0c7ad23ef35a4329529ad78df4e80bbec4bfbaa98b2
TLSH
T1CA4131E15C3D1AD0E0BE0AAFB49B34FC84D8C326F5A4307D2C58E998467960D654143F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1205395013\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1205395013\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1349072970\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3524_1696827400\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download