38d8d265a1a5cbb90bb1e16cd6b49e2f159be1faf91219486b2a7ca0a4271295

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Code/Avec thème/rand.html
Size 1KB
Sample260601-pgalysdt3j
SHA256 38d8d265a1a5cbb90bb1e16cd6b49e2f159be1faf91219486b2a7ca0a4271295
MD5 d5c1d4758d736990a1995f3bc5b8527f
SHA1 5590060c7e29e1362c6813b7cd73fe28f2aab307
SHA512 93ceb1fefb9afcfbc4266c9bd4ff85e91d7d8f186c0928cba3e7bb0d9600c389fd2bb2696322ca99ec8370efb76a63219935a81ae9773b18fad02058e5f01da1
TLSH
T139313D165E4D9E1F03505E49F4F0B61C887F8F31AA4D8DC9F0B3054F7B82188DA0AAC6
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5592_1590546012\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5592_1521756031\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5592_1521756031\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5592_1590546012\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6120	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247904145333467"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{1511E47B-8FEB-4178-BC55-7F600AD55B6B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe
5592	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 576	5592	msedge.exe	80
PID 5592 wrote to memory of 6120	5592	msedge.exe	81
PID 5592 wrote to memory of 2216	5592	msedge.exe	82
PID 5592 wrote to memory of 2216	5592	msedge.exe	82
PID 5592 wrote to memory of 2216	5592	msedge.exe	82
PID 5592 wrote to memory of 1460	5592	msedge.exe	83
PID 5592 wrote to memory of 1460	5592	msedge.exe	83
PID 5592 wrote to memory of 4080	5592	msedge.exe	85
PID 5592 wrote to memory of 3872	5592	msedge.exe	86
PID 5592 wrote to memory of 4080	5592	msedge.exe	85
PID 5592 wrote to memory of 4080	5592	msedge.exe	85
PID 5592 wrote to memory of 3872	5592	msedge.exe	86
PID 5592 wrote to memory of 3872	5592	msedge.exe	86
PID 5592 wrote to memory of 1316	5592	msedge.exe	88
PID 5592 wrote to memory of 1316	5592	msedge.exe	88
PID 5592 wrote to memory of 3152	5592	msedge.exe	89
PID 5592 wrote to memory of 3152	5592	msedge.exe	89
PID 5592 wrote to memory of 4100	5592	msedge.exe	91
PID 5592 wrote to memory of 2148	5592	msedge.exe	92
PID 2148 wrote to memory of 5232	2148	msedge.exe	93
PID 5592 wrote to memory of 5428	5592	msedge.exe	96
PID 5592 wrote to memory of 4612	5592	msedge.exe	97
PID 5592 wrote to memory of 4216	5592	msedge.exe	98
PID 5592 wrote to memory of 2968	5592	msedge.exe	99
PID 5592 wrote to memory of 2968	5592	msedge.exe	99
PID 5592 wrote to memory of 4276	5592	msedge.exe	102
PID 5592 wrote to memory of 4276	5592	msedge.exe	102
PID 5592 wrote to memory of 3268	5592	msedge.exe	103
PID 5592 wrote to memory of 5236	5592	msedge.exe	104
PID 5592 wrote to memory of 5236	5592	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Code\Avec thème\rand.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7fffeabfc188,0x7fffeabfc194,0x7fffeabfc1a0
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,11173709794342564431,3159837552678004771,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,795816207339625269,4862380673148430446,262144 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,5626151828906612358,7857220655554884044,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4987160918553446806,8573339090888932463,2097152 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,12981193543437897995,2597660657703976486,2097152 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,2282683449850328146,7509586276859773261,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,18436276031948738417,18162256383903854724,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,4930780143113311417,1281191303029849919,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,4930780143113311417,1281191303029849919,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,7465699596408352210,10228023134418909641,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,8209841356390724064,1385267033130486173,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,15826578949731315320,2549682328647879188,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13917452546374921528,2625375679194779912,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,9551341814508895343,17675980376152446519,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,6877374585306985103,15843117170125391144,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,9618455951800415753,8288969505783250988,262144 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,11981329331085096724,7112155129793493986,524288 --field-trial-handle=2204,i,16808780734078350915,18327571575587332520,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

34504ba8-284d-47af-88b9-a9bc84db6713.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34504ba8-284d-47af-88b9-a9bc84db6713.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 35f509ba7e2d8f49c4d1cbeffc0d15c43d47989f12d4f66e9d901c48f9001fb0
MD5 4bab5fce6ef0c911b8027ff9ca6d4f17
SHA1 d6f998bd2ea3fd58fe769c56969a8a0eb2155c1c
SHA512 81741c90d50ed319cfb31e7fde30fc8f3bb3a7dfc7e63e1d8b32df570365b65f4fd894cded1778a9b96de51039dffdba0de703d1b9860ff4a25ee8c1b5ff180e
TLSH
T123F0F9BAC920AC2714FD0B1970A50B4AEB5013673780895F3B3D420C4FB163B468585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79659c8d-c14a-4ff3-a976-48cd848ba964.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\79659c8d-c14a-4ff3-a976-48cd848ba964.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0e6df9adb8358e9af5fea1a0f50664c6330c9a1ce86ffd905acc542409b749c4
MD5 feaaf5c235b4c08b312996af6b7c89b5
SHA1 90a455ed3e77cc0bfc16ce01a96dd937808ac266
SHA512 e9521d4f2579203e47b4b7a90a0f1c3ebc556616ff79392d957af2ed2aee2b21eb7f16c80b6775c762396d78972666bfbdba678c01edfac0750a94e1fcddaf4b
TLSH
T1E74190F7C3E8856DC90195F0B6287E2BCE1D0954432C7D5AC5E4AF1B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e87d151c038b1e6eedde0bbc29d0837f0578011dd95124c6e871f33a532037f1
MD5 eb75d1a27a59e7b6de60596fd11757c4
SHA1 05ad7c5eec1016fd485f744e37954164fee590bf
SHA512 6876bd4a51640dfe4041d5ce2d6199a6464a4fa9d62de1f790292c53939290141a3a42d6c191e716c05cfb2e7a33e5df548104234f7a3caa2c6075df672487d6
SSDEEP 192:sxZwRRyMqZjK1Ml8UQnFZ/fRs7zeE0CXUyynDHzodpE8/W6+WNGY0dGEagIg5ZPZ:sxZw6qFZ/fRsHh0Ly8M9/bG5xjvYDC
TLSH
T10C72E716AA38997B8CDBD219F6457F53D3F9157292504E44AAFCCF0C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b9b8342eafe725c7daae9d436ad8f33f08ba40242c71d1770f78c3d568a25caa
MD5 a6c55644e8001c3fe5988dcfb614375a
SHA1 833974fd986bedb709e77f453f54c80389e84a75
SHA512 f8cebdfb2c3f02cde2dfcc9f5aef2b1836673178c494e43b26a6173b912da1cac765ad1f260dcd265d70dd531f663e1b9d71d87db6dc9ccd61910b6ef39188e4
SSDEEP 192:sxZwRRyMqZjK1Ml8MFZ/fRs8DExE0CXUyynDHzodpE8/W6+WNGY0dgEagIgjxJ:sxZw6dZ/fRs8DE60Ly8M9/bG57jj7
TLSH
T1EA62E716AA3899778CDBD319FA457F53D3F9153292504E44AAFCCB0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 581d5f90e36bc68dcfaba54bde411a71598b4a4f048babf0665d7ec29ba306f7
MD5 2adaf5f96eccbac90bf393053694ef9f
SHA1 ccf5fceaabcc4c2d74ece2ff29f0e8671e2c8d58
SHA512 e01533cb13d41a0b0440e2f5dff2700bc5b9c3e5047db0162eac39cb50ce9e58839f361c7f015198d3a0c156fa1e5500b9ddefc7594bf5f35ed7d15061b7611a
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV363pQLla:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK63p1
TLSH
T156031B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 217b24770b09813063f0f40d840e1c83f141bea555e3bcd6de629261cf59ab22
MD5 78434058888c795020a832a490d02bfd
SHA1 905bdc84e8cb74f3131b7736512b8b3501ceb219
SHA512 497f1271ec6aa7043758d071ccf5a3bd9a1ed329f1358802701afd2192a6d9d547b5476ee213338a53df4843d8d4446f03865bc058b7accd122f82f135a869c0
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Ofd3w:AFBHhTofhno2mBeaOfd3w
TLSH
T13FC28D57717B12023C3E291CA6A19B770E8272A3355CA56F7BB800B64E67E215DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a69797426599e5f814c1e93be44636174ab9a2fdb4acc7f6e4a16e708a851aab
MD5 f9bad5c8b1b111aa7bc2e32959eae84f
SHA1 6987505a3daa0e44f0c01ea4671fa5ad4f23fedb
SHA512 9383d88c17fd0aedf8de8efabdeb41942bf60776e438cdfaaca147924c3382e2351f09cac9ad00789e07f8e704a3853100b118291a928278649b7e795e28affb
SSDEEP 384:yaiFmtNnNnb9V38Nu8TUNTUlIRtyK/yjGfbwoUytO65ym5FNfvBh+SoVKz6Zl1zg:0FmjZb73xwgtaox065ZvBh+SoVXzjTq
TLSH
T15FD24B32D864CAB7EDE79FD9A70A7A03EFF402A385885AD4DAD95D0D00C729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0bf93e65f3e823510a1c3ce621cc2699eae6f43bb1d57d64fc07c2927730c62e
MD5 2673366eff4d2c79eae096b45bab1b84
SHA1 27cef8d3792bb7ade4163012169acf8ce03303ff
SHA512 76108025c9159c420e2056119ee6869534504470e20f3cc24f8c3a4cce543b36c603ba8e1cd56b8e078d4561c5b6520ed751a872c2ef2bfda119355c08b201c8
SSDEEP 384:n5siF9CcmyWCs38Ng8TUNTUlIxBydvsoyajGfbwoUytO65ym5sAhkP+lFYS/jfHA:dFccps3Hwg5riox065qAhkoFYS/k
TLSH
T1A2B25C36EC58CAB7ECEA4FD9E74E7A02EEE01163859899D4CAD91E1C00D71DD1707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 75459898f4fb4956e1576399a4e25bf9f82e26d115983552ca2ea17627c080af
MD5 0f07cb3b54c01bbcb398e02bbf8b8230
SHA1 00d720d9814a2cd3c16baf8bd637e29c3965f826
SHA512 a381694364db02bc9ac9f726e44bc6b8c762bbd0657db8a1e12fe797366aedacfb4b6e594449718df6b2034d1eed3e6d725e476c0a71e256941a909ac3511808
SSDEEP 384:y5QiFmtNnNnb9C38Nu8TUNTUlIRtyK/yjGfbwoUytO65ym5FNfvDh+SoVKz6Zl1s:cFmjZbQ3xwgtaox065ZvDh+SoVXzjTq
TLSH
T162D24B32D864CAB7EDE79FD9A30A7A02EFF502A385885AD4DAD95D0D00C729D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6caa8e08c95521469d1a7e80536902d76041fb4c2dea17796956920c9743edcb
MD5 f8041db673b3f97d75d4b5d7e7b444b5
SHA1 f4a6ce9c68588044619b156a33e1e20f1a90297c
SHA512 1ab31d7ad575d03cf615891a84666a74772f543c7a0ff539994dc82198a3baf586d8a5eff972449c63c200bb86841b11e9ec6a4aca1fd1c48f499af04d760963
SSDEEP 384:y5QiF1tNnNnb9s38Nu8TUNTUlIRZyd/yjGfbwoUytO65ym5FNfvDh+SoVKz6Zl1s:cF1jZbC3xwgKaox065ZvDh+SoVXzjTq
TLSH
T1A2D24B32D864CAB7EDE79FD9A70A7A02EFF502A3858C5AD4DAD95D0D00C729D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0f0e5f2a813cd4296feeae515767fb2813e129be9ad3d9bc4033f7b8ddccefbb
MD5 40dbddc5b84017a7ee048e9d485c0fa9
SHA1 da63044217e602b9395eadcfb8044085f667004f
SHA512 6ff16b0163c0ab0a852d054a7a46d8a865eada80951348d09b6584480c07cbf18cb33ed9ef0e33415c7fbeaa678fcaba9720c69dbbcff9f27a3e8d3a66fc2fb9
SSDEEP 384:yGiFmtNnNnb9C38Nu8TUNTUlIRtyK/yjGfbwoUytO65ym5FNfvDh+SoVKz6Zl1zg:MFmjZbQ3xwgtaox065ZvDh+SoVXzjTq
TLSH
T1E9D24B32D864CAB7EDE79FD9A30A7A03EFF502A385885AD4DAD95D0D00C729D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e0cbee17981c47c4ff5d6ccefcc45841c6665c8a8af382f122a7dc7e5e587def
MD5 d0af3b96407a1e9245632e323aaa7443
SHA1 d905e4eb14f8130d684aa20d4a87cdae63e9b6aa
SHA512 053aa6d190cc21d1f5871fdc5b8bf13a68077e86955e3e6b3ef1096b872aa325ab2f0ed2d46c4b8ef62e6960eff1c75ae050564ffe18ed441c6bae0edbe84918
TLSH
T1884130E15C7C2AC1D4BE0E6F648B38FC81EC8725F4A035396854EE94197921D608587F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fcdabcc8a467aa9de2b45ee7e81bb24e2e2ebaab9fdc6cf85acd30d977c0df9f
MD5 a992b2ca230bdb8e3cdb9bc03f4e14be
SHA1 8587f4f8de9654d701677a5f96416092ae491d27
SHA512 bd400f4ca74fb016b4dc4f18a6279df9bf078c5a4cac5d31e62a56ef535bd5c206ada8dc2bd66ead628a318b30615414b59d70fe5c89d9ac6e0102bb9c0919b6
TLSH
T1004141E11C7C2AC1E0BE1A6F608B38FC91ECC726F4A034796854DED91A7961D658487F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5592_1521756031\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5592_1590546012\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5592_1590546012\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4100-166-0x00000269BD650000-0x00000269BE650000-memory.dmp

Download