850f3ba4ecf28b8710e3b0a5255b2660df7b635302dfefbab02111eb88f9c4db

Analysis

max time kernel
148s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 15.2MB
Sample260522-pegx9ac15v
SHA256 850f3ba4ecf28b8710e3b0a5255b2660df7b635302dfefbab02111eb88f9c4db
MD5 ebf5480f681977d018fd188c9da2bdeb
SHA1 7bdbbf1386f4741556c5a96ec3f53a63050b68fb
SHA512 822b6e12d4c0d96409dc14d26e104e9e0ecdeca4d78e15f004a7cfd0190009ec21ab143edda037b1660b316b4f61bfd699a9fa38e64fcbba9c032cfe8597ed7e
SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+U3r8xd2zJQf8xF6DNgQdGxw:w
TLSH
T1D9F6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1676_951705538\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1676_951705538\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1676_923059121\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1676_923059121\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2092	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239259378583552"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{EBB0A54D-A300-4A3C-BBE2-35946669F7F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 5196	1676	msedge.exe	79
PID 1676 wrote to memory of 2092	1676	msedge.exe	80
PID 1676 wrote to memory of 2620	1676	msedge.exe	81
PID 1676 wrote to memory of 2620	1676	msedge.exe	81
PID 1676 wrote to memory of 2620	1676	msedge.exe	81
PID 1676 wrote to memory of 3916	1676	msedge.exe	82
PID 1676 wrote to memory of 3916	1676	msedge.exe	82
PID 1676 wrote to memory of 4260	1676	msedge.exe	84
PID 1676 wrote to memory of 660	1676	msedge.exe	85
PID 1676 wrote to memory of 660	1676	msedge.exe	85
PID 1676 wrote to memory of 660	1676	msedge.exe	85
PID 1676 wrote to memory of 4260	1676	msedge.exe	84
PID 1676 wrote to memory of 4260	1676	msedge.exe	84
PID 1676 wrote to memory of 5300	1676	msedge.exe	87
PID 1676 wrote to memory of 5300	1676	msedge.exe	87
PID 1676 wrote to memory of 5868	1676	msedge.exe	88
PID 1676 wrote to memory of 5868	1676	msedge.exe	88
PID 1676 wrote to memory of 3752	1676	msedge.exe	90
PID 1676 wrote to memory of 3644	1676	msedge.exe	91
PID 3644 wrote to memory of 2368	3644	msedge.exe	92
PID 1676 wrote to memory of 3132	1676	msedge.exe	95
PID 1676 wrote to memory of 1752	1676	msedge.exe	96
PID 1676 wrote to memory of 4732	1676	msedge.exe	97
PID 1676 wrote to memory of 5552	1676	msedge.exe	98
PID 1676 wrote to memory of 5552	1676	msedge.exe	98
PID 1676 wrote to memory of 4064	1676	msedge.exe	101
PID 1676 wrote to memory of 4064	1676	msedge.exe	101
PID 1676 wrote to memory of 2560	1676	msedge.exe	102
PID 1676 wrote to memory of 2264	1676	msedge.exe	103
PID 1676 wrote to memory of 2264	1676	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x21c,0x240,0x244,0x214,0x24c,0x7ffcbfdfc188,0x7ffcbfdfc194,0x7ffcbfdfc1a0
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,14692871290374635172,8094354362213864602,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6280034473912408193,10628560373747777729,262144 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,11798353247087485370,10754875719613518417,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,10986402481552611421,11421298953099540360,2097152 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9852742491610194528,15799200299506585965,2097152 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,10723042654900756489,13507668740497227990,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,10526700733737674116,17232220941056146883,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8488640476090368577,14247872562266726428,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8488640476090368577,14247872562266726428,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,2501484797994958894,13479300021622834982,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17624318016271149394,12695170127880404454,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,16045769284875218327,246451755978019615,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8315409954714249961,10814198662510517827,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,17320295727389476729,3538520132368352318,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,10728585903920152951,1327455313254213516,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,16523334550468028732,17291114663319524864,262144 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,13243949919986520580,3616920920119173059,524288 --field-trial-handle=2192,i,2069925855031320063,17124745099393081597,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3e52c4a5923f53cfe96f2226c6a71f61863e62342ed39f77de504c4f218fc52c
MD5 b09ec7df251e47fbcd5ca1c47a3b992f
SHA1 2715893263bf8fcc6115cbc69fff3b7a543b2023
SHA512 2a719438617cc21ecfd36d3a302cc4789adc07810319dbe934d4b93265099954dd9da969a3445eda4ad48069998ee297bdf7ee619eef9fde27d9e8b664d53944
TLSH
T114F0A9BAD921AC3728FD0B5E70A51B4AE791136B2780895F3B3D460C4FB563B468981C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5dbcb416d54632f59d5836eee3cfa15abb66351a0862f6fea0e980288a6ee347
MD5 35ddb42c60a2327d6a1ee69622842d91
SHA1 39d2b99966c3ff3746a3357c3bd9546c2bca028e
SHA512 083b44bc0e2409477238d462c4b99d682dd75b0ffbf56ddcec42fb84884aefd1bf88fa671001678a701de09e17d8c35366ed4858d93d551cc416330613e4dd24
TLSH
T189418EF3C3E4856EC90155F0BA187E2BCE1D0955432C3D5AC5E4AF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f4dc81147b4d81efc64e6c5a6bfc8c02f1b5ed06077c15ecb888d9ff773d3b19
MD5 50f8792699961cdaa14f0ca082a85188
SHA1 58ff1ddb8798246b88056a202a4e1fa30429a166
SHA512 2365f3fbda1aac1e90259e9e1d0910f991cd6703f41614a47fc6b845a12b947f9d2da0955b2ed5a7b85c88f531efd539fa7174befd2b8971c58c1f2e6a55bc61
SSDEEP 192:sxZTReyMqZjK1Ml8UQOFM/f2sCF0E0CXUyynDBzodpEb/W6+WNGY0dUWx6+5Ig5w:sxZTzq8M/f2syb0Ly8qK/bG5nx6qIR
TLSH
T17162F806AA38597B8CDBD31AFA557F53D7F9153292545E04AAFC8B0C04E7ADC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2c2f95969cc4bb6f83e1f95cf0dcbe565b576ecd18238c66699e70c912caa228
MD5 46f6dd503d3660ed551c8763ad269afe
SHA1 2b669d13df58cded8c906590c0bd9c0815330ae3
SHA512 be6e0521598239813c9a3de5f64a824f45515cd4e43a9da14d22d20881f04a0640b36a4b6e1ca68bf4ed1b273436c853f133b57fa7b18b246a9c1379eae92e1a
SSDEEP 192:sxZTReyMqZjK1Ml8MFM/f2s8jFyxE0CXUyynDBzodpEb/W6+WNGY0dgWx6+5Igjq:sxZTzdM/f2s8Jy60Ly8qK/bG5jx6qjq
TLSH
T11F62E806AA38597B8CCBD30AFA557F53D7F9153292545E449AFC8B0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0115354714894c866f01c2829c8cee55120dd5c068fac3058ad1658799af6aa4
MD5 07d411f83f7164a436a3d6a3056a3af3
SHA1 b0993537a17246e32d1d978b48a752f1c7d84e4d
SHA512 3bce8e6564b870f5b5195afb2cff228820c54c70ddc7a80b7041ab8d977c28412cf1822b8d7a009580685ad7df7751df4f06951e1e2492bc55f600094f48d6c5
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Y3pQLl+:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKY3pV
TLSH
T178030B3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3282bddae6c7c11db052f42b04f1f54526733f4f186e904b16095a2c7202261b
MD5 7b6998fd22c09e46bbc22ed00e2526b9
SHA1 86149cd72bbf05a20a3bc2e86a4afaa56f3e231c
SHA512 f710da59759ee2f26de7a86719ccf21b413220bd3e6bb5c5b6ee31b9319ec66013cd20ebf120258cb99dde1ea95fc8705b3f7bc5d7a38fbfbceffaeb7bd90752
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7qni:AFBHhTofhno2mB21q3Llbfe3sLDdeEpJ
TLSH
T168B28056717B12023C3E291CA6929B370E4272A3355CA56F7BB800BA4E67E215DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0c68df361dc88d03b0ea4ea1352f2f42ce721f80685c4ec223779f208b1414f0
MD5 ddb1f7d18aa835dbfac07e59858daf2d
SHA1 1afaa2953af41db47e727c12efee15555143ae1b
SHA512 02fecf869676074d959157b55f6705334fc0059a1cbb44ccdd5d587a71d3430d16683f9df343da56969f3f50d50eea64b930226c322fe41944f835d464864505
SSDEEP 384:nqBiF1tNnNnb9I38Nq8TUNTUlIR6ykVMAjGfb7oR+q93yV0NzgYHKYW1bb7vHy/V:3F1jZb23FwgTjoRX3+4zgYqzbrA
TLSH
T128F2C5F698E789B7E8AE4B87A33D6E029ABCD163B4484584F7C44D5DCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b048af2781452f3b49c539de33f82ab0a61f507210659fe8987bb86b53ed4a3f
MD5 2b307cb86eea3ae63c070db6bcf8e755
SHA1 53fe9e9da33c864bee7cbdfc296a88f37f3dbf26
SHA512 3e9746c75c2b00234db8b379c6acf48d4515ce0f31fd841ea2aafafd85f99961f7e6c9d7c19e648e6231977e991d386389a43194f0abadd8db2c12fd0db74e50
SSDEEP 384:n58iF9CcmyWCs38NE8TUNTUlIxBydvVoYajGfb7oR+q93yVOzEhkP+lFYS/I1lfl:9Fccps3jwgsDxoRX3+OzEhkoFYS/Mt
TLSH
T1FCB25B32EC99CAB7ECEB4FD9A74E7A06DEE011A385888AD4DAD81D5C00CB1DD1747C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b8611738a8680ecbdcdedfd5106a34831561312139db1fc8dd257017a8724d58
MD5 575a9cc67105af11ca8b8176c6e68972
SHA1 9cffb07c4a34d863bb333c940b59286df61aed6d
SHA512 11a7acd16cb38f017576b8a85fbada1b6f8624649188e93970a52573bc08dbb319541153bb8e7f6e8c45e169432658f1df44c57d48572209ab7701d320325ce3
SSDEEP 384:n5riF1tNnNnb9k38Nq8TUNTUlIR6ykVEAjGfb7oR+q93yV0dzgYHKYW1bb7vHy/V:UF1jZbu3FwgrjoRX3+yzgYqzbrA
TLSH
T154D25B36EC64DEB7ECE79F9AB34E7642AFE011A385884AC4D9C85D5D00CB29D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0727b8503d06b3c7abf3b6dcfce38d7a5260bbc839a7a4342bcf97e3d693000e
MD5 aa204e94323f5bc41614af8683e12260
SHA1 6ae132e5ec8e8cb4b1bef9f939a914218a183030
SHA512 97778aaca99626172c47c7b924da9fdd724ba45ae7b9df096f416a5ea4ee70a740099c5fed692a38a89caf6166561bb8a7d16379f48e9d13a59f55d4c59266a0
SSDEEP 384:nliF1tNnNnb9k38Nq8TUNTUlIR6ykVEAjGfb7oR+q93yV0dzgYHKYW1bb7vHy/75:sF1jZbu3FwgrjoRX3+yzgYqzbrA
TLSH
T1AED25B36EC64DEB7EDE79F9AB34E7642AFE411A384884AC4D9C85D5D00CB29D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 36d0303323c1e30848253f3f095113e6552659cfe44415a028d362ed2e2cca15
MD5 e6ea12748189448ada3cddc0e8f5929d
SHA1 9e8a1e060da9ca02c3a55e3c4d579367adcb737b
SHA512 3af173f8ed74e75e8a1a234c9951f9325b49dc4a294746c9291644b63c7f68793d8e539af7f52a085fd0378cd5b9b2601ddf9c4670b0944254976bd0d97529aa
SSDEEP 384:n5riF9CcmyWCn38Nq8TUNTUlIRkykvEAjGfb7oR+q93yV0dzg9Hy/7IgW:UFccpn3FwgnjoRX3+yzgr
TLSH
T1E8B23B32E869CAB7EDEB4F99B71A7603DEE05163858C8AD4D9D90D5C008B2DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a060288fcbfd5528c375518c349ecbb08cf365d8e4ba4631121dee76a23df8f1
MD5 7695c6a383c137db82fb422563e29448
SHA1 74c55c37c91f585ed0fa1e7d5cef7445fd4f2590
SHA512 4c67f71b8ad87ad7ebaa9bcab8e6a582d748a86c67e2c28fccd324ae2476d28cc299d90251eb1f75f9d9924b5f49432fc4cdc186bc2e33e08a115a149ceb9d2d
TLSH
T1D3414FE15C3D2AC1D4BD1E6FA48B38FC82ECC725F4A075396854EA980A3961E708087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9d8bec11a85402edd8df6b8a8948df4b84d5a65e1b997b628fee97e7173f9f29
MD5 b6217606227217e872f31aab83525313
SHA1 afb45ba55cd8882a89c7fe8f3539ad506d9abea5
SHA512 d18cbf1fb4c25d834cd454b5e585c6a5e504ab39f86787fd94e7c91fad1c8eb650fb1130aff9d61fba9b9ae86faf1e0d403c649b11b83619f447ce7045e96935
TLSH
T1834130E15C3D1AC1D5BD1A6EA48B38EC81ECC725F4A435397814DA980A3A71D308483F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1676_923059121\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1676_951705538\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1676_951705538\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3752-167-0x000001B293000000-0x000001B294000000-memory.dmp

Download