f47029665a7ce04b423d7d2226d3cec3128ada2253c1b2f3f7e54c89d7928ce9

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium.exe
Size 74.9MB
Sample260517-t1eggabs31
SHA256 f47029665a7ce04b423d7d2226d3cec3128ada2253c1b2f3f7e54c89d7928ce9
MD5 fea8cc743350f00d313c91db0ee0c0d0
SHA1 b7e5d53fd929f875a9b3ca01052b5782a6a06b56
SHA512 4a0e16b1975c575f0ef230cbfc016c6894b259399a8b29288549aaab6229d080d22a5c4c85679d52d25985e866f79c2ef57ded90ade2f3a383906dd9f773df29
SSDEEP 196608:y9dnSC5K+xrIHs2XTWMrdMmzZf9dnSC5ZudFcc+/m4hvmD:y9dnSC55xcHs2aMZN9dnSC5Zg+/TRM
TLSH
T1760818F9936023BCDC4957BFB96138B4B60F747A37D5CD94C22E4E92581789ECA09883
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1469687617\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1056346982\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1056346982\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1469687617\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4428	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237060258394592"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{79503F9C-F393-4295-8A68-EC2FD5D74455}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5024	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 5024	6064	Potassium.exe	79
PID 5024 wrote to memory of 4260	5024	msedge.exe	80
PID 5024 wrote to memory of 344	5024	msedge.exe	82
PID 5024 wrote to memory of 4428	5024	msedge.exe	81
PID 5024 wrote to memory of 344	5024	msedge.exe	82
PID 5024 wrote to memory of 344	5024	msedge.exe	82
PID 5024 wrote to memory of 1216	5024	msedge.exe	84
PID 5024 wrote to memory of 1216	5024	msedge.exe	84
PID 5024 wrote to memory of 1404	5024	msedge.exe	86
PID 5024 wrote to memory of 1404	5024	msedge.exe	86
PID 5024 wrote to memory of 1404	5024	msedge.exe	86
PID 5024 wrote to memory of 5256	5024	msedge.exe	87
PID 5024 wrote to memory of 5256	5024	msedge.exe	87
PID 5024 wrote to memory of 5256	5024	msedge.exe	87
PID 5024 wrote to memory of 2040	5024	msedge.exe	88
PID 5024 wrote to memory of 2040	5024	msedge.exe	88
PID 5024 wrote to memory of 2040	5024	msedge.exe	88
PID 5024 wrote to memory of 2888	5024	msedge.exe	90
PID 5024 wrote to memory of 2888	5024	msedge.exe	90
PID 5024 wrote to memory of 4760	5024	msedge.exe	89
PID 5024 wrote to memory of 4760	5024	msedge.exe	89
PID 5024 wrote to memory of 5472	5024	msedge.exe	92
PID 5024 wrote to memory of 5496	5024	msedge.exe	93
PID 5496 wrote to memory of 1660	5496	msedge.exe	94
PID 5024 wrote to memory of 1740	5024	msedge.exe	97
PID 5024 wrote to memory of 1500	5024	msedge.exe	98
PID 5024 wrote to memory of 1800	5024	msedge.exe	99
PID 5024 wrote to memory of 4992	5024	msedge.exe	100
PID 5024 wrote to memory of 4992	5024	msedge.exe	100
PID 5024 wrote to memory of 2136	5024	msedge.exe	103
PID 5024 wrote to memory of 2136	5024	msedge.exe	103
PID 5024 wrote to memory of 5960	5024	msedge.exe	104
PID 5024 wrote to memory of 5960	5024	msedge.exe	104
PID 5024 wrote to memory of 5200	5024	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.AspNetCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffeefc9c188,0x7ffeefc9c194,0x7ffeefc9c1a0
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,7468946516385126576,9681582715906013241,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10229242539743588372,16662528727899919117,262144 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
    3⤵
    PID:344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,2247547585530689325,18300506170292455226,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,1043404193751102812,15507757752810373819,2097152 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,3266358649135889881,1908600026874113170,2097152 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4832,i,7582561596195205980,16793423877204470739,2097152 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,9437622380318432224,10922925983618623822,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,10870314831114012322,8276620872379916931,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,10984209276708639555,9477845001179064752,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,10984209276708639555,9477845001179064752,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6513076171801833566,10819146608733046650,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7626289616311481674,7841502202142798696,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17666576659040281043,10166688531033806259,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,4072924282532956635,17230190181985960738,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8324399946622793405,9150808502857219826,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17047605523499093766,14824048929430930148,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,8798601167077391090,8569349875899015667,524288 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:14
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4736,i,3103208001522920511,2622221280354089897,262144 --field-trial-handle=2524,i,6135512423552554496,9741299813419828089,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 10ee015d29741fe94af81d0a6535c5b3f782e97ad971fb734314cc5460f3ee15
MD5 af70c74fd623569a6886845df808c7b0
SHA1 7283b96e2f363cbc77f18528037083c05d35df01
SHA512 1989349535147875e0917a7a35fd2cb1e1e741f5846462d938123b7666835145a4ef31f8ab92bc28673bb22a4f5729a6332b08190fb5ceef7804d0088c45f52d
TLSH
T193E02BEACD21983B09FD271D60546745EB0413971B414A4F3B3CC1088FB163A4685C7C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1c97f808fcfbfec6a3ccbd3f0c982e4d3331665f19deb92266a2f576b58837c5
MD5 3bf1c6a04da72ba9a2fda47d85c90cd6
SHA1 4ea06cabca28a4a7730317e4b1f7300b235ebf51
SHA512 0c5191e7dbf8f49a48bd45fb668bfd71678161b02d1d0dc61ee91d46ee61b99943615926500953dc38252a5b5a79602318bc54123cefb4cc5c6f783f801cd1d9
TLSH
T14B41A1F3C3E4856ECA1196F0AA18BE2FCE2D0915431C3D5A89E4AF1B93E3471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9d5c3bb3bb9fc40c802cdb471ba88c805ea6bd9a7f9426db6146edeef6ce75a8
MD5 2cbdeccf91dcb89d8ce1bdc5852a51cf
SHA1 0355b8dee1a471d313370aab9ed1a34d5da9f3c9
SHA512 87502e4934ac2e1f4b9c4eea26cdbca58640ccbecdd783f9b8651502c01b81a91d9c4dc44fd8222a35daf6f8261effff7e97cc27bdea9e05c2acb31f22086e62
SSDEEP 192:sxZqRLyMqZjK1Ml8UQHN0/f3s6UKTG5GN2ewGzodp5b/W6+WNrEvI/Y0h5CWIg56:sxZqYqt0/f3s6UUei23V/bj/5VItp
TLSH
T13C62E7166A689D778CDBD319FA55BB53D3F9556292904E049AFCCB0C04E7AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8e92179078a862f2407c846a9410e3b72532dec0767dc3fbc88d5c5b1238c8c3
MD5 2c78a22a34ae11df3e1843ed00150f8a
SHA1 f13cfc16c7f668378411befdc5a1427fe75cb0cf
SHA512 bd889d9c0c2dc6a7de72dc000acdc821a366297bb1733e6933582106ba88e593dcfd7e843d32262ec60ff4d7a3d2de1eb231d3d72c6dc47e526b4096895018bd
SSDEEP 192:sxZqRLyMqZjK1Ml8MN0/f3sS+KTG5GN2ewGzodp5b/W6+WNrEvI/Y0hXCWIgj+ZJ:sxZqY10/f3sS+Uei23V/bj/5rj+D
TLSH
T11762E7166A285D7B8CDBD319FA55BB53D3F9556292904E449AFCCB0C04E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 8020f2e0d3beebc6243f38c5fe0796d1aa0ab51032161a5d07127ddef946c847
MD5 3feae424ef45eeb1019da4699fac8200
SHA1 794d843f707810654a9c3aed04548ec9d7e918f1
SHA512 f5ef380eb6453f664fd6e81b97a132854e8ebc9ebf56ace2694d6aa20a0f580a7458bc976f2d075922710662ee04e89fcbab76f4c505e478e9e4dda8b9b8c1c0
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Azx4Ll8:wQAKq8y02yqEnjbWRmj1QWTu1jaKAzxj
TLSH
T1D1030A3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 128427a7f11a1e8fc7157a5261094188a8b36b21b6ac0daecd01fccb7dd34b6f
MD5 7f6f0d88ad4ee06726acdc4b034a0c6e
SHA1 97a4668d22045f5359b1f74cb925182a16bab057
SHA512 38c7722503aa64cfc0cf25e428459d32b05e7692c342fd6d4ba59bcddc250715fb0c2ec4dbc9648ea9b1e3e13a2c237ab7bc5220ccc5e944b58324d589cd8c47
SSDEEP 384:GZLVDJjEDPV0/ZdWiPWS84U945+qeB20NySZ8WH:GZLVDJjEDPV0/ZdWiPWS84U945+qeB2a
TLSH
T15DA2591232BA02423C7E390893968B674A42F1633459ED7F7BB940B64E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 56a5fa7f17e82951ef62ba6a7f46907bb61a4600cb48f69f1788920d5d374c47
MD5 61937039989b8e0b05ae73d0684ad933
SHA1 874d8caa7bb1a8964598c9cd902a167a508b89e2
SHA512 6d3e2b0cacccdc5e206dcae9c58d89a8d9a9582cc71e7cf7ad82e17d5f98305001b8505a9a1b197a0affa88a4b79265e959fda5d8beb02994b3f94c659b7df57
SSDEEP 768:qFccpq32wg4Kekmk+ti6PVdZwfYB3QkCfH+Nj6n:+q3vktfWgkJW
TLSH
T107F2D4F598D78977D9AE4B87A73E6D029EBCC163B5444988B7980D0CCC871BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d43d6cb00829a43fe76d41aedfea43ebe891867bff48b544ed0b2f49168c172e
MD5 33a7319a0d22ffaf2f6f4bc505b4d979
SHA1 ffdbb58e01704503e14aedfee189d1ef2aba2f02
SHA512 8f82678d689d1a67e56b952557263fe181ab69b8bc27daa3cc4c2fa0e28a29f3fea23f0ff0ef6c818e572825e7b54a48531aaabf33ae39fa915cf027b0b0a228
SSDEEP 768:kFccps3MwgqGmKekmL1wGwfYxQ4qI8p0e:0s3dG2kcgfF4qI8p0e
TLSH
T1DCC25C35EC68CABBEDE64F99F74EB602DEE01123959899E8DAD81D1C00971DD130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6759141d01a73e24c260c5a473d0b2b0faaaee17a6b019bee4ab7bb93abf43f4
MD5 33a9e0e825b44cc3b8f57b46c5973d08
SHA1 c71881aee0c4cb62853b7128070136eb222ac462
SHA512 6f1bf1376dbc409972a947730b1543836b3de021204d310ea5af3e2003d56cbf879fe7d25146c5d9214e25000981eca54e99e012e2910f80832fc4cf5dbe7d75
SSDEEP 384:ndiF9CcmyWCs38N98TUNTUlIRePm3ek32nn9v544Jfb8Gqic3ZffwL9obQ+DCddD:UFccps32wg4KekmrUGwfYOQkCfH+Nj6n
TLSH
T131D25C35EC68CABBEDEA4F8AF74AB613DEE00167859849D8DAD95D1C00871DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1c46ef8630b64e1ccc1c37e08ae97ed69b7964ace043151cbac2a95c0699b51b
MD5 20ed9d626cec7b893266349b9c4fbf95
SHA1 8df746a080b589f4af6e1a4b5ea81c9215802f81
SHA512 2e73fa8d93115783ac30be35cea07b96f71a454ff0ec0ab180012f47a13e50dc7d417e9b5d61c928d7a2f9d029ea89622d7806d0ecd91b0bd3a5e4339541c859
SSDEEP 384:nuiF9CcmyWCs38N98TUNTUlIRePm3ek32nn9v544Jfb8Gqic3ZffwL9obQ+DCddD:FFccps32wg4KekmrUGwfYOQkCfH+Nj6n
TLSH
T1ACD25C35EC68CABBEDEA4F8AF74AB613DEE00167859849D8DAD95D1C00871DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b16251a32202e9ae23c0ae913940eb448ce680501bf96177856745bd1a117b40
MD5 73ab91e36b0b2e77f7964f0ed458569b
SHA1 7c389383e603f4182633245ad77c2d61ca7918a2
SHA512 85533eaf8f94d69582f6e372ae7d2e13ddf3447890525144ec2ea98554878df2173daacdc109f15f6ea23d9e72264e8d00c78e34c223edb86e0dcb66b92a419b
TLSH
T1815130E15C395AD1D0BD0E6FB48B34EC85D8C725F5A0347E6C58EA584A3960D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 531a703c6247bb241318472982b63b1f480812cdea3c555773f2168b82312bca
MD5 057e60715ef9644eb07f8f9e3b10135c
SHA1 da6379f4bc4cae07ba624d164427b5e8451a0c8d
SHA512 71df756e5c2a2f6708ab6776d0899e5b424bdce78e6afd46ce4731726e596ecd7aa59b194df5b5e04608364dd659ab432201d346bec16031b19303bd00dcc02a
TLSH
T1865143E15C382AD1D4BD0A7FB08B34FC85ECC725F5A4347E6C58EA984A3A61D248143F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1056346982\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1469687617\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1469687617\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5472-166-0x0000014B137B0000-0x0000014B147B0000-memory.dmp

Download