000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d

Resubmissions

31/05/2026, 08:21

260531-j82xmaez5p

31/05/2026, 08:20

31/05/2026, 08:16

28/05/2026, 15:35

28/05/2026, 11:37

Analysis

max time kernel
148s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample260528-nrbrbsfv2x
SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
MD5 1ca87d8ee3ce9e9682547c4d9c9cb581
SHA1 d25b5b82c0b225719cc4ee318f776169b7f9af7a
SHA512 ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
SSDEEP 24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ
TLSH
T1D296A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1358854744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\model.markov	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1358854744\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1292214708\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1292214708\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\english_wikipedia.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3404	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244421640787107"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{AB5A46A3-8F30-4F9E-A90E-2DC06F1DD936}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4972	3096	msedge.exe	79
PID 3096 wrote to memory of 3404	3096	msedge.exe	80
PID 3096 wrote to memory of 3160	3096	msedge.exe	81
PID 3096 wrote to memory of 3160	3096	msedge.exe	81
PID 3096 wrote to memory of 3160	3096	msedge.exe	81
PID 3096 wrote to memory of 4524	3096	msedge.exe	82
PID 3096 wrote to memory of 4524	3096	msedge.exe	82
PID 3096 wrote to memory of 2852	3096	msedge.exe	83
PID 3096 wrote to memory of 5968	3096	msedge.exe	84
PID 3096 wrote to memory of 2852	3096	msedge.exe	83
PID 3096 wrote to memory of 2852	3096	msedge.exe	83
PID 3096 wrote to memory of 5968	3096	msedge.exe	84
PID 3096 wrote to memory of 5968	3096	msedge.exe	84
PID 3096 wrote to memory of 1708	3096	msedge.exe	87
PID 3096 wrote to memory of 1708	3096	msedge.exe	87
PID 3096 wrote to memory of 5752	3096	msedge.exe	88
PID 3096 wrote to memory of 5752	3096	msedge.exe	88
PID 3096 wrote to memory of 2972	3096	msedge.exe	90
PID 3096 wrote to memory of 1548	3096	msedge.exe	91
PID 1548 wrote to memory of 688	1548	msedge.exe	92
PID 3096 wrote to memory of 2344	3096	msedge.exe	95
PID 3096 wrote to memory of 4744	3096	msedge.exe	96
PID 3096 wrote to memory of 1108	3096	msedge.exe	97
PID 3096 wrote to memory of 5644	3096	msedge.exe	98
PID 3096 wrote to memory of 5644	3096	msedge.exe	98
PID 3096 wrote to memory of 4844	3096	msedge.exe	101
PID 3096 wrote to memory of 4844	3096	msedge.exe	101
PID 3096 wrote to memory of 2184	3096	msedge.exe	102
PID 3096 wrote to memory of 2184	3096	msedge.exe	102
PID 3096 wrote to memory of 3544	3096	msedge.exe	103
PID 3096 wrote to memory of 4664	3096	msedge.exe	104
PID 3096 wrote to memory of 4664	3096	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffd8b2bc188,0x7ffd8b2bc194,0x7ffd8b2bc1a0
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,9645233258890330530,17917230533449580156,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,16567662345150377469,14638268010839317011,262144 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,15923462460775365618,10481650350932089922,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,15297510548576664541,510476200112327183,2097152 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,11190156040163612794,18020408316071224562,2097152 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,797806703775489094,1367916610664928733,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,1905486640344256650,16046373076650739955,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,4109094413949501062,16279480307374880360,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,4109094413949501062,16279480307374880360,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17321451280757009730,14328851424573818017,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,324832731955552670,2182687882642045841,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,13416120410332344677,3070996002217705619,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,12465838363750177050,13692213804169158456,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,13861801201785305146,2711023004379953904,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,4459386807168762308,8062200394996259630,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16646429923465571783,11416348203290005633,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6032,i,16063361049723941871,6697206755738922461,262144 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,11258720167204383179,18013370727563726789,524288 --field-trial-handle=2232,i,3497467434456364724,7948024925436960756,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a61fc6b3cd4e0a8eddfdb35f6c21681dcefb8f1c31f1fe973a0aab5141e66428
MD5 5aaad9178b366153f23e1367981c0d3b
SHA1 c941e740e252fbed6d4686ea55a8e3cdf6f38760
SHA512 d79e1e233b8bb350b83671dde09f2ab7a2a48ab0cb6340e3e21f5beb73fa8aa0a9139298849dacc8712d97c0cbe9a7e91d2b40c88fecbe58ee4c7694b0ccaa3f
TLSH
T17DF0F9F6C921AC3709FD1B1860645746E74513972B81495B3A3C920C8FB063B465586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8575041c0d279aa418a485bccbeb2a8c5d4a050553146033c2711f57dda3ba86
MD5 7a938bf44c201767ec20ebc41a98e9e1
SHA1 c7d5aa1c1559b582d21563f83c6fe1d4ecfa45d4
SHA512 4dc64ff2917210ec25093f9dde325b34a9c3dde615f5ceaaffd2b40208f4441206fcd2bf7a6a316c773e4fe1aca0499e01b733d79de4e7079d3abc134c93ac16
TLSH
T1F441BDF7C3E8856D8A1195F0AB187E2BCE2D0910432C3D9A89E4AF5B93E2470D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 21e7217d1212f694e80ab9ae5455504c45b1158125605cbf8d8672eae082540b
MD5 60a1203ce4657dd0ccb5b403120c6479
SHA1 a8900d81f98b60e8f777a14bd38eb5edc0c5b0a8
SHA512 cb9e7a34872d0876b2a36a4d8017911cf33eddcd9346ce1adf723b1adf7ab318482ab38263a2fffc544fb0f7fbbb73fa8014b1c972f46e89196da83c9d555f8c
SSDEEP 192:sxZg5R1yMqZjK1Ml8UQUFUg/fksX4IKTG5GN26wfzodpEO/W6+WNGY0hXfLzgIg1:sxZg5uqiV/fksX4IUei2i3/bG5eAfTwF
TLSH
T17472E9066A64597BCCDBD319FA557B93D6F9153292905E489AFCCB0C04E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 50ad2b750276920eafb3e3a12322a5f80d07b6ee02bd420e2ddf5a1fd3c44fb5
MD5 928e172e3abb7f523d821aba9c6da95b
SHA1 243ac0a94a683ca2b81dd97ec00e1ca01ea104bc
SHA512 9a14cfe645938f817aaea05a43385c685732d9da31f9b21ddff959967cac6ef246f4a5e6896b760d3681da7ecc5aaf877ef4939ca2211672179e7562b35a65f0
SSDEEP 192:sxZg5R1yMqZjK1Ml8MFUg/fksj4oKTG5GN26wfzodpEO/W6+WNGY0htLzgIgj+JJ:sxZg5udV/fksj4oUei2i3/bG5sj+z
TLSH
T1FC62E9066A74597B8CDBD319FA457F93D6F9157292905E489AFCCB0C04E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b366aa6d104d366d0deb6f1b088ecb48d22ee0f3553d5e1b2807e9b2106fbde4
MD5 02d1e17cfc881951100af3c058597a70
SHA1 631068f1924ed23e2a52e12c861b3fdea0392cbf
SHA512 8a681cfc82a8f694a290d9eeb6c1d7955b80978b02ae37ab5658b847b91e943714ae5a291f38e38572acbc152fed73a3e05852ebce84d8efbf999f6ed8f0b6ce
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3rzx4LlI:wQAKq8y02yqEnjbWRmj1QWTu1jaKrzxf
TLSH
T1F0030A3B680CCB7E4FC04E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 45aa300981d63d84b60e63298e2f21991d795718922cd594fcda26c7e2324b38
MD5 8af54318d5018a7678a2ad385854acc2
SHA1 2c0e2b478653d578eff4fcbadf2eff2ccde5b102
SHA512 a5fbeb77f7dedc605de50c03f607187f6666d2d5d90e81435db65a056b3bc774f794b5dd14b150622314f1f159bd360817c12a73256b6add987e651d870954c2
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5k:GZLVDJjEDPV0/ZdAbj
TLSH
T19BA2490232BA02423C7D390C939687674A42F1633459ED7F7BA940B64E67E225EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3112465fad18610e62dfc9e1168611f1d28c83b66ec4b9a3788a892e0c445625
MD5 07092194ad8fa4df0ad50a53cab6d18b
SHA1 56ff3d122bd25265ad67543040a615c2281a5ef3
SHA512 391ed85d457db1647761dd11a41f38a81a913081618d4a43ffd4f5b4285ad4671c0f5fc3463cb0c77e7e5089d20429b1415e36403e792ca1d167169b508d93fa
SSDEEP 768:MF/jZb/3swguKekmp1GqUTZr4crBST+R2M3PY:QT3bkftr4cBSk3PY
TLSH
T17CD23B32D864DAABEDE64FD5B71E7607EFE40267898C19D8D9D81D4E00D329D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 66372c415340aa68148308650f4fb408cb1654fb092f073cd53d3a82f7f3656b
MD5 4be954232dcf65161f933c34e673e19b
SHA1 3774ae9e740aea9bad193aa4fe29d4a736e5bc92
SHA512 3769d42ed4c67c00f83347377e4241c117d7e3408b398acf6e7cce6cbae9c44e2acc2dfcea65cfcae42ebb4000e40924b75fdee794c6d420a06c629b53ea3d8c
SSDEEP 768:iF/jZbF3swg9Kekmp1GqUTZr6rBST+R2M3PY:OB3ukftreBSk3PY
TLSH
T164D23A32D864DAABEDE64FD5B71E7603EFE40267898C19D8D9D81D1E00D329D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 734d35f33092f060ea2055b382969c7532a60fd4aafdffd5199846b3a69bdd05
MD5 463437aee88ad7f03414e604b92c5eea
SHA1 ebea8a8141bfb48c0c8b29c47da93f15cfeaefa3
SHA512 e164698bad798800665e95765654c21a0461ac8b2565bfab2c7206cf00b28d4f3a3830d1498314dc68016cc234b0ef2165a6f340a03bebfe6e858dca6ef90c0c
SSDEEP 384:nQiF9CcmyWCs38Nf8TUNTUlIxBPm3ek32nn9BVQxsSufC8GVMUTZXbPPu6e4KV8I:rFccps3QwgPKekm9WwGqUTZru6I8p0x
TLSH
T145B24A35ECA8CABBECE64F99F70EA607DEE01263859C59D8DAD81D0D10971DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f278c7837e7a47cfecd84782f80d9f86325b80fd1d1e424581ca7707afdb0722
MD5 f8311960607a934f5980d2f118a481bb
SHA1 cffd429d6b43cdc4c32ec738376e8d149ba032a5
SHA512 7171947eb7b79ba42cfd8bb564b0b653e6c155257ffb8e31521d5a77af1d91628d8c00c2007a96e3e64c13161ab2424ea758839653b4be113ff28e66cbce84ae
SSDEEP 768:sF/jZbF3swguKekmp1GqUTZr6rBST+R2M3PY:wB3bkftreBSk3PY
TLSH
T184D23A32D864DAABEDE64FD5B70E7603EFE40267898C19D8D9D81D0E00D329D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d8928fac14f588c8fdde68f640c82e7b2e8b90b55540f39e943d18d818901a27
MD5 fefc6a3a58cda0cb90d4914270540ea0
SHA1 295ad94e0e2fab5f5453279e00c674c593a292fd
SHA512 62cfab28658ad216469b56226bbf555d618f96aaec569a1f796b5592ecebe5ba579947a0c839e5c124f42396d9671602ae5c3f370c430ea6e693536ba65c289c
SSDEEP 384:nniF9CcmyWCO38N78TUNTUlIRzPm3ek32nn9d5LSufC8GVMUTZXbPP8XTrGEqktT:iFccpO3swg9KekmZ1GqUTZrcrjqQ
TLSH
T1D5B22932D864DEBBEDE64FDAF71AB603DEE01163898859D8DAD90D1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 33fef8ca374e3b7d13828d1381fe94643ea1f86606268afc6aadc49c8608881e
MD5 b4e7842d9a3ac4dbe60cc6b108fba579
SHA1 0e0a572028c32bf4899e8629838b3e97d040f282
SHA512 9390d1e286efec7001f565a289ae2bc8a471f9f294dfaf6ae04154921b63cfdd71abec670ffc3c294975793398ff791730259a43ccc65edfb9838b57d9bfc8cd
TLSH
T1EA4130E1587C1AD0D0BE0ABFB08B34FC84E8C326F1A8307D2C58EA98467960E654183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b2713b53b35381cf2e8b4a19af3b802028dc2360e983e1aee60f4d5c32358dca
MD5 ac01b90369d255a7750c4e2d2c539847
SHA1 0dc70aeb281c3c264aaa2d63b8348dc6202d368d
SHA512 77114b0f7b45c8b6a51250ea06a9a05c3d9c1ef1816f3217bfeeb3051db589434763e4f06286787ec0b9e0c7ad23ef35a4329529ad78df4e80bbec4bfbaa98b2
TLSH
T1CA4131E15C3D1AD0E0BE0AAFB49B34FC84D8C326F5A4307D2C58E998467960D654143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 808b9f935facb40437b13a8595c21f33ab28e1dcb95e8932136554475c6f78e8
MD5 4b68812f490bcd2060cac3e9c9e2cc7d
SHA1 fe976c905351c49d608994f3d6804b00028c78e9
SHA512 ea6ef88a8a1e997751b72b537a7f081d0eb4d2527ae07fd0b40f8c6e5ef980f44305228939844c9e57f0825c1cd9a830057983b074c4ddffbd9f3c1cdc6267e4
TLSH
T1ED4111E1587C1AD0D0BE0ABFB48B34FC84D8D726F5A430BD2858E998467960D654143F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1292214708\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1358854744\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1358854744\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_358715492\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download