hxxp://roblox-exec[.]com

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/05/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox-exec.com
Sample260515-xtltrahx9p

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1290664485\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1747772603\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1978756367\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1978756367\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1978756367\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1290664485\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1747772603\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1978756367\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1978756367\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236904900937167"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{5D20EBB2-FC0F-4261-882B-7F5B885202D5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 6000	5872	msedge.exe	79
PID 5872 wrote to memory of 5940	5872	msedge.exe	80
PID 5872 wrote to memory of 2204	5872	msedge.exe	81
PID 5872 wrote to memory of 2204	5872	msedge.exe	81
PID 5872 wrote to memory of 2204	5872	msedge.exe	81
PID 5872 wrote to memory of 5912	5872	msedge.exe	82
PID 5872 wrote to memory of 5912	5872	msedge.exe	82
PID 5872 wrote to memory of 4716	5872	msedge.exe	84
PID 5872 wrote to memory of 4716	5872	msedge.exe	84
PID 5872 wrote to memory of 4716	5872	msedge.exe	84
PID 5872 wrote to memory of 4012	5872	msedge.exe	85
PID 5872 wrote to memory of 4012	5872	msedge.exe	85
PID 5872 wrote to memory of 4012	5872	msedge.exe	85
PID 5872 wrote to memory of 1268	5872	msedge.exe	87
PID 5872 wrote to memory of 1268	5872	msedge.exe	87
PID 5872 wrote to memory of 1268	5872	msedge.exe	87
PID 5872 wrote to memory of 5736	5872	msedge.exe	88
PID 5872 wrote to memory of 5736	5872	msedge.exe	88
PID 5872 wrote to memory of 5104	5872	msedge.exe	89
PID 5872 wrote to memory of 5104	5872	msedge.exe	89
PID 5872 wrote to memory of 4016	5872	msedge.exe	91
PID 5872 wrote to memory of 1036	5872	msedge.exe	92
PID 4016 wrote to memory of 5992	4016	msedge.exe	93
PID 5872 wrote to memory of 5316	5872	msedge.exe	96
PID 5872 wrote to memory of 1788	5872	msedge.exe	97
PID 5872 wrote to memory of 5600	5872	msedge.exe	98
PID 5872 wrote to memory of 5224	5872	msedge.exe	99
PID 5872 wrote to memory of 5224	5872	msedge.exe	99
PID 5872 wrote to memory of 5440	5872	msedge.exe	102
PID 5872 wrote to memory of 5440	5872	msedge.exe	102
PID 5872 wrote to memory of 1916	5872	msedge.exe	103
PID 5872 wrote to memory of 1916	5872	msedge.exe	103
PID 5872 wrote to memory of 4204	5872	msedge.exe	104
PID 5872 wrote to memory of 1664	5872	msedge.exe	105
PID 5872 wrote to memory of 1664	5872	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox-exec.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff92cccc188,0x7ff92cccc194,0x7ff92cccc1a0
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,9480811321146786161,12469246232800594053,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,14848418894393450171,808288407070445847,262144 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,3454786996416717765,8748196862064020450,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8310581005084542939,8782046786520154297,2097152 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3262361856423964989,15406359226214333002,2097152 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4892,i,1774104322171266409,16257786986768475877,2097152 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7888202868265144983,2167627361195077949,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7531405764145746789,1001624478921793209,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:14
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,8142481588465782206,13155512245522065520,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,7680208632326099082,11024321104662231913,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,8142481588465782206,13155512245522065520,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,16055783969340455121,9835383397838497827,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,14049816427606405001,11163713849167345710,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8371369663166660304,225297939332472035,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,13746941514742089892,7799509600680411675,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:14
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,12157154984736686281,10068946315676567026,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,14005597647078468692,8138006305953782081,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6396,i,15809319329592280049,4905487454988082673,262144 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,7587411488975028010,6899136838003952807,524288 --field-trial-handle=2024,i,17943233666415571719,10833959250811299446,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1d47b2e9ac08fd9a8432f6e86d1ea25c8934e0e4a027c84bdce9c77637c9469e
MD5 f9d74fee2f1c8e593ce30633c991e5bd
SHA1 6d8c07d210c7a71f3ab4e67a56c16d7e3f352622
SHA512 a3c0091c626ba302f0d6aa9a7c5605cfe62fc0fed9454908eaf3d8e1aa0dd82a45168542789330038ca9d28b0aa8133f216990afc2a4be49792498226461b250
TLSH
T101E02BEBC930AC2718FD4B19A165174AEB51135B2780886F7B3D850C8FF172A0685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 71b142fd2ca6b18c9d98be0cb84c44503cea4477854fe0e46ef7d3d15549d865
MD5 9c6fad7549c41c695db0f7dd2c85dc29
SHA1 1deb16b1bc7d03885e9958e9b2fd4729ba02b4fc
SHA512 c09d4bb2af77fe02407b0f94645bdc8a2cee3ba86bd808300c0dec3df5bc984bda3b541aae354f3f272a62633ad61a69f48f752eeffc3bc4f481aa6e7f7a306c
TLSH
T148716FBF0383049FE32019B1E5E1D9097B7C6EB7A9937E59208C8C79151BB30F55EA89
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58678f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58678f.TMP
Size 3KB
SHA256 f1729d60aeecb7a818c7b0253027638a29380775a4eb686360ba3a5593b1f677
MD5 7a7fee63f4c6573321b7a1b6b0e1b4fe
SHA1 1016d7662c1e71732932e010c5411d0f4493b1bc
SHA512 2cee1b8a3cc78cf3849f33932f2678fd55199a4f574a58d876f6a863469f2509825dd24ff128e9116ff97d7b7ae7ad085dd9e7adfc232991f57dadc083e9541b
TLSH
T1697160BF0383045FE32019B1E5E1C9097B7C6EB759973E59208C8C79151BB35F55EA48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3feee0faacca7686d1fa3dd80e2a7e320a66341da0a37fb0b8a554d631a0ae04
MD5 c5716696898bf9c555ffaa6e23a794b9
SHA1 37921933c0ad042c3ed3bf82238a140990664dc4
SHA512 bfa4dc7b8b389eda03a3cd5511a5b989b54142914f73141d3c4aedfbae3ce91111dc13956174e36d19b741a493213ec606fa7ea614ba85cc2887f5a1444c7a3c
TLSH
T182518DF3C3E8866EC91156F0AA186E2BCE1D0914432C3D5BC4E4AF9F97E2471E24198F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b2c6ce85e9feeccbe0cc95c47acb5465bc3c6c3e4a6e4985f0c0b5370c2bd12e
MD5 5a3a6447691e26856aeb82e30a0772f2
SHA1 5002957135a5af209f91b5f0abb78f5c971b4878
SHA512 a29b7359e63993b5168e2682ebe5db9b29a788fdb64245d0603aba0568f78687cedb4a6e64ce5298ef129237968b0a7572794d6766fa2fc1ad7aadceba63b231
SSDEEP 192:sxZIRjyMqZjK1Ml8MFs/fPs8RZxE0CXUyynDlzodprld/W6+WNby4/Y0duWGEIgA:sxZIMds/fPs8RZ60Ly8u3/bV/553jeF9
TLSH
T1DE62F8166A3859BB8CDBD319FA457F53D3F9152792804E449AFCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6f85f99ce5b13d10c2c10349529bc83cfeb12359c50ec6cbd8433af909b3fbd2
MD5 6f5e20244b9a5386612866af73461fbf
SHA1 783e32f510da6245c01e967fcb056412c7ef018e
SHA512 bdc20e4dba6a3b7db1b3533c738ad1813949ada8c7a35ab798bf8863b8fc5a84c06d6f14167d8f5f53e8d90e67178093dc2be48fe83a7e0ab9ed531099bc614d
SSDEEP 192:sxZIRjyMqZjK1Ml8UQgFs/fPsKZE0CXUyynDlzodprld/W6+WNby4/Y0ddWGEIgS:sxZIMqWs/fPsKi0Ly8u3/bV/5m3wl
TLSH
T1A0720916AA3849BB8CDBD219FA457F53D3F9156792400E449AFCCB0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1d2c190df290fb0afefe572e682e709d98e6ba9cc99b121a88760161a4fdb9b8
MD5 7f59602d5d0232fcb5faa3973e7a2c5d
SHA1 20667e32bcabf961d2a16375a995c3152323cf5a
SHA512 63018cfbf018cfaca93111d85caacd42740221c730354dc45bc2cb9aaaace7f4524b489567c2ef63cb8297c83a9d9dcd963d596a8e7a678db7778fce73f9212e
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV383pQLli:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK83pJ
TLSH
T130030B3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 af8153b95baf78b94aebf776dc64c7848823d7316b2ffcd8e7567af5ba9c9e0a
MD5 633d334307866bd4f0a22209116060e0
SHA1 e150d914e4aa07d643ab36205552ffcfc3074db6
SHA512 d024bc0b98cbaab05d4e84cd20c9fe50d1cecdf4225848df5f12fe96edccfa3ca4df3c6acdc201c23cb1614a9b25f885ae47996e5a5318c0294065c38d9b340b
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ODG:AFBHhTofhno2mB21q3Llbfe3sLDdeEpV
TLSH
T1BDB28E56717B12023C3E291CA7A29B370E4272A3345CA56F77B900BA4E67E615DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 35a18b89ae9941490bdab671bd23dd054a233e118823ff7a4ec06d69b3607214
MD5 c1dd6ebb44c3dfc1424735b69251ea67
SHA1 2b3f0b0febd4ba9c6d63ca42d800132d660ef856
SHA512 4e553deaf41390ae69904ef77ef89e8a29385f37aafe10f933cc6fdae4b5a63d1981e7182d950f4fd884e2306255dc74c8187ca7c64a7776469a610b0b306ba7
SSDEEP 384:nQiFdCcmyWCF38Nc8TUNTUlIRzygO+gPujkpfb7ofalgAYSJocIILkYiPHy/7IgP:rF8cpF3/wg4+g/JofatRocIIoYiAjxn
TLSH
T178E292F198D789B7D8AE1B97A73E2D429EFCD157B5884984B7840D0CCC861BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6d29fcad6b99c9716c728371ebacac9f7c62c95122fe005a97de56605660f1a0
MD5 219c0d93ac9862bdf12cdffa7dc937f9
SHA1 587a4514bd0621f2ea4d6a91c9a7c31ae4f3f820
SHA512 41ddebb5d2ab299cc25de46ca975db4e1266365ce4aa9e181a5633ce7f16ef1ba9136be7d73b1920c1ac40456f61ae1c8fcc36de06e4328bfd40f3fff75f7f05
SSDEEP 384:n5riFdCcmyWCB38Nc8TUNTUlIRzygVPujkpfb7ofalgAYSJoRIILkYiPHy/7IgZR:IF8cpB3/wgj/JofatRoRIIoYiAjxn
TLSH
T1D5C23A32E8A8CDF7EDE61E99F74A7A43DEE451A7858C4AD4DAC44E0D008B1DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d5dd6d49eb93077b7b06374ee5591801da35b18f8c2617108bbb8eb8a43440bc
MD5 1574dfd6627715c3d153426ec0916958
SHA1 53825e2737e78b9ab13e2d78755bbf7a6d39a15b
SHA512 02b76a02a027ee9f83fa96894ee671f7bd61a0868a90fc4ffa618487283feafc89541dc09b1402d4f35adfe2585276ffc4a56dd6fd83431a8e3c563bf21b8554
SSDEEP 384:n5fiF9CcmyWCs38NP8TUNTUlIx0JYydvuoGajkpfb7ofalgAqoOhkP+lFYS/TsHG:wFccps3AwgqJ+B7Jofatq9hkoFYS/F
TLSH
T1C6C23A32ECA9C9B7ECE74F99E74A7A02EEE01163859C99D4DAC81D4D00CB19D570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 eb399ecc19bbc3de73bc5b7d7d8b3dc87ba372cf1a0d59141ffb2b5cde8c9791
MD5 6d1f6ff3a5731ee1eb38ff288f768639
SHA1 23b2a92c841a16f353488979da11d8b6854032b8
SHA512 122717e2b88c4e286c4635b976bdea13a810d2162a9d3e4215534f1588c94089ef7d627bdbfaba21b46dc67398e3ed63a4a3b72ce480eb2cfca83ba88d5d1b1f
SSDEEP 384:n5riF9CcmyWC+38Nc8TUNTUlIR/yqVPujkpfb7ofalgAYSJoRIILkYiPHy/7IgZR:IFccp+3/wg5/JofatRoRIIoYiAjxn
TLSH
T123C24A32E8A8CDF7EDE61E99F74A7A439EE45167858C4AD4CAC44E0D008B1DD070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 10c6d496b8e54d93bb05ec10fe01420320397eca6a9fed7d825cdc54f04b359f
MD5 da33a63cf27428f62b21ef1c5090be60
SHA1 85161bb36e63a5ab51782b4ff56122d1c97d09b9
SHA512 fbf692cb567388247013e8583b8ad449c9a7c2c06c9deaa7738cbf8c166d11680a25c90edbea2ba62aebcca38d9ea0ed35232cdc3aec34d6fc00761a652da6e6
SSDEEP 384:noiFdCcmyWCB38Nc8TUNTUlIRzygVPujkpfb7ofalgAYSJoRIILkYiPHy/7IgZjt:zF8cpB3/wgj/JofatRoRIIoYiAjxn
TLSH
T1BBC23A32E8A8CDF7EDE61E99F74A7A43DEE451A7858C4AD4DAC44E0D008B1DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f869fb7902963d551af605ffcc232aad3509e26f4a31d2ce2239b064fdb85f91
MD5 d938b45ef1ebb692fd552c5b5e525772
SHA1 65be111d98b48df0b0cfa4fbb3d83100ad8af44b
SHA512 8e417182c2df312648bc1e78af19771e665f07df6ba04693dabc94f02bf0c3ddb7ac8ab5dd876a62c2db8154a914d6df09f47ea9ce5079390188f07bbe7c41b1
TLSH
T13B5160E15C7D2AC1D0BE1E6FA48B38FC82ECC725F4A0757D6818EA98097921D708187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8528835aa26454113f77323eeba61fee78187b92e507ab411a61ea64a26e4d80
MD5 47752d9b0e490dca1663fe4df678699c
SHA1 7dd0915d02ad467c2000410712bbbe3e5c1e7a7f
SHA512 9b56e2bf882320033b93277becf1f041d044c7a2c813ae7e5b563d26426bd8039dc7eb21a451a252eb7df712729dfe049939cacf0aab13f0c6c09cc356b93789
TLSH
T1845151E14C7D2AC1D4BD1A6EA48738FC85ECC725F8A434396858EA99097A62D608487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b7d407d6e2e12a117dbb640550bcfd2ab6de9852fd44e1e22878e215a99565b4
MD5 006f30f79480e3a52c5af3c7d61ee52b
SHA1 c8beaf857fd775119bd7b6738e49c0b1c9d35940
SHA512 84e63cd2795cb98104939ed4be89318021e95217fa4e60dfbaf9098c076c007f14a766a7397f9df556bc2f4580faccea6ab68d0a6d4c956a5d0c8b85959bff64
TLSH
T1B55142E15C7D2AC1D4BE1A6EA48738FC81ECC725F4A4347D6818EA990A7A61D308187F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1290664485\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1290664485\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1747772603\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5872_1978756367\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download