dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee

Resubmissions

24/07/2026, 22:56

260724-2wxq9avtey5

24/07/2026, 21:25

260724-z9vspstdpg5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium/Potassium.exe
Size 146KB
Sample260724-z9vspstdpg
SHA256 dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee
MD5 301a5357ec4151273a737a57a211c7a5
SHA1 482fe3a0f2e701c69f40134e71faf5c134cd1fae
SHA512 db8bef0960722e0372e1af2eb8057ba7640dc140d5710f301c2896d997fb1222c645e0b3b7a5a138b8a0fd4a1a316cc71f305b9a9170d728a4851f2abfd76d89
SSDEEP 3072:QhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuGEL/:QhK4XycqgpfCup5sVxuZ04uhAD/
TLSH
T194E34A43B2AC00FDE1BBA3788AA21906F7767859477197CF0390C56A1F67BD09E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1281699072\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_237404741\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_608873895\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1281699072\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_237404741\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1080531529\_locales\uz\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134294071900874985"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BAD782EE-B098-4C89-9BCE-C3B2A5D1D80C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5784	msedge.exe
5784	msedge.exe
5784	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5784	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 5784	4508	Potassium.exe	87
PID 5784 wrote to memory of 732	5784	msedge.exe	88
PID 5784 wrote to memory of 4972	5784	msedge.exe	90
PID 5784 wrote to memory of 1636	5784	msedge.exe	89
PID 5784 wrote to memory of 4972	5784	msedge.exe	90
PID 5784 wrote to memory of 4972	5784	msedge.exe	90
PID 5784 wrote to memory of 1748	5784	msedge.exe	91
PID 5784 wrote to memory of 1748	5784	msedge.exe	91
PID 5784 wrote to memory of 3132	5784	msedge.exe	92
PID 5784 wrote to memory of 3132	5784	msedge.exe	92
PID 5784 wrote to memory of 3132	5784	msedge.exe	92
PID 5784 wrote to memory of 3956	5784	msedge.exe	93
PID 5784 wrote to memory of 3956	5784	msedge.exe	93
PID 5784 wrote to memory of 3956	5784	msedge.exe	93
PID 5784 wrote to memory of 3512	5784	msedge.exe	99
PID 5784 wrote to memory of 5580	5784	msedge.exe	98
PID 5784 wrote to memory of 3512	5784	msedge.exe	99
PID 5784 wrote to memory of 5580	5784	msedge.exe	98
PID 5784 wrote to memory of 6116	5784	msedge.exe	101
PID 5784 wrote to memory of 1276	5784	msedge.exe	118
PID 5784 wrote to memory of 3308	5784	msedge.exe	119
PID 5784 wrote to memory of 1104	5784	msedge.exe	120
PID 5784 wrote to memory of 3376	5784	msedge.exe	121
PID 5784 wrote to memory of 3376	5784	msedge.exe	121
PID 5784 wrote to memory of 4404	5784	msedge.exe	122
PID 5784 wrote to memory of 4404	5784	msedge.exe	122
PID 5784 wrote to memory of 4480	5784	msedge.exe	126
PID 5784 wrote to memory of 4480	5784	msedge.exe	126
PID 5784 wrote to memory of 4368	5784	msedge.exe	130
PID 5784 wrote to memory of 4368	5784	msedge.exe	130
PID 5784 wrote to memory of 5360	5784	msedge.exe	134
PID 5784 wrote to memory of 5360	5784	msedge.exe	134
PID 5784 wrote to memory of 5192	5784	msedge.exe	135
PID 5784 wrote to memory of 5192	5784	msedge.exe	135
PID 5784 wrote to memory of 3920	5784	msedge.exe	136
PID 5784 wrote to memory of 3136	5784	msedge.exe	137
PID 5784 wrote to memory of 3136	5784	msedge.exe	137

C:\Users\Admin\AppData\Local\Temp\Potassium\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium\Potassium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/TGNGNMJ?title=Dependecies
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff8444cc188,0x7ff8444cc194,0x7ff8444cc1a0
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17665503417409961291,13837492548123119877,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,785236356726977868,15375979320891444486,262144 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,14851714354343116040,1368646611313922132,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,12304316000103734678,1811161133002231473,2097152 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,5181994814034204775,6340945394153406139,2097152 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,11552710695091399702,10161758901765715907,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,16243235564646572418,16890463700071390740,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,12333687277973024609,18152950827146852598,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,12333687277973024609,18152950827146852598,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12705049396198445137,9351297740143687977,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2381861395694090165,4095845252420207428,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,15137976247252835311,7503110244340781476,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,8731451002854169208,3147158375798223776,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,13662515338432811096,4755055300640234355,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,13511648556302088623,14378161299596762843,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,17020164717713361907,7894158889447541528,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,6962822955271777014,2281647768232500040,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6253743625630708180,14049758727470502123,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,15855968187311739498,967309097524904498,262144 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,12994297712969706906,16177267364712561079,524288 --field-trial-handle=2256,i,7939173692923083248,15192629683019869988,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1281699072\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_1281699072\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_226000239\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_237404741\manifest.json
Size 53B
SHA256 6954daa257636bd6d9563ff3568dcd9845bf9b99e587d490da2306bf0938b684
MD5 caf17c4608f6bf58bf0d56e1e63c1570
SHA1 5cbd60bf29e30e477627bb8d094272a35a3cfa65
SHA512 92126322986cdc0ce8ea76ed1ee484b9955aa3dc061156f2e0012d9f1bd5b1583f9f2e4d9eebaa6db250c95de6b1cb44b30a4a3180a01f2724947fffbb9ebd18
TLSH
T1D59002604414951716D10E5066B0B8819391661995850D1D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5784_608873895\manifest.json
Size 118B
SHA256 69f118c3e7f78f02e2e2a669db02f9481cab660b7c73ef5fddf5694604852b8d
MD5 7007d4e7071e61158b58278b9ccd0903
SHA1 be762e1094f744249d1c6b26b7d68391f8d1bae0
SHA512 9e33760d2db57e52d58dd1c6bba14977c3cab66b3f98616dffeffdbfa6100b827d33e8238e2ef0c9f4e94b7bd8fd62f7c106588be5ce5141ce11639c15194050
TLSH
T1FCB092B00C0AA03B22819720ECA0668A83F80218E8029B1E088036481F8817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5c343269166a90eaa968a83afe45d8f64638acb6f705fe44857edf4a8f613cb9
MD5 2d90a9e1bd4676b762a1ff6772615949
SHA1 4c7458e78d9cf189a82c841ab86719754f4135ef
SHA512 5721db90396a1716d2e5aa2ed0acd47c9d2ccf5f051ad2ab7524b8ebfbab10e203c5b54fdd9575bae62d28b4394a12a9faa7403a26b1e74988fdbe5d082f19b4
TLSH
T1D7E022FAC822EC3708FD0B1DA01A8B96E71013272A41895F3E3D82098FB062A46C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8298e0fd9f2666f6a1033aaed33a8aaada0f504625d09239475a5721816e2a78
MD5 8fdb149fe7712295b44e1f489aba6e22
SHA1 ab60a5548cd6a71dd507a715c9fdbdf1b154ef9c
SHA512 07eee64079b20492a0eddab86d400ec204e1e867f6ca29616bcf70eed33a7d084d0a741a0f602603cedb2252610f2d2dcc80c6e2476f80049ae1f3349efc58c5
TLSH
T181615D35F902D878EB63033195E07E64B8B481E9FFEB5EF219A444757CC6B18436D298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 916bbed722e97505b9770e4d057e6343ea9b954fd095ec39aefeb5a4fdb2b1b4
MD5 f757c309e05103a48a837c6b14788baf
SHA1 d9e8b99edeb13b78c86742f67a7fab47b929d8c9
SHA512 337e70735edcdde69c8e59979f1f01f5c0b61265232f975b810921e4177b1d6c9125e4318eb4ac0e8401d18b9f7b3d48862aa8604f3e7d6b5a80f9c92313b190
TLSH
T18251BDF7C7E4866DC91191F0AB147E2BCE2D0525432C3D6AC9E4BE5793E2472E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 84aa042f7b5665ee6ca11907f614579a134cc593d06f99b4ac01901adfca9757
MD5 dc6613723407940ae2f8263f1b35fb84
SHA1 6ce27af4f69f7f94e3648b2def827fa5a80eccb7
SHA512 be5971083ba35f089fb6d8097c1d5f1d42fdeeb14ebe363fe4f6c47af03891a4eb42487e0e783a775063f76bc565c4e9d1355d71aa74d93a4707282abdcdec3c
SSDEEP 192:sxZuRc7yMqZjK1Ml8MjP/f/sszqtaZdIaRuvHzodpyAHW6+WNi5sT/YvQuuo+rTi:sxZuaS7P/f/ssetazIKYMPHbii/yYje
TLSH
T13062F91A6A249A778DDBD209FA45BF53D3F80163D1945E44A9FC8B0C05E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 dae4ae39fbc264334afff6753a4ddf44177d9e791650808b56937b9c30524071
MD5 881fbfa787d4e5d0cb6d22980bdb103f
SHA1 dc75038cc10d3dd94c8414d47007c22d0c312376
SHA512 91c29c3910be92c665242ec38805c1351d338cccb2da4629e41a77a7513fca9ed0f6ead968489d39c5c53d5ae3f1b80295f8f4e5b02b6b09f811258ceaade6e4
SSDEEP 192:sxZuRc7yMqZjK1Ml8UQLjP/f/sdqxZdIaRuvHzodpyAHW6+WNi5sT/YvBun+rTI1:sxZuaSqfP/f/sExzIKYMPHbii/3YJy
TLSH
T15572FA1AAA749A778CDBD219FA45BB53D2F40162D1944E4499FCCF0C05E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 82e362bf178a0a7bc2b818f25e7e414bed4292b97cda77d6e26d035e9056a691
MD5 444c911e3b9e1a520cc3bbffe4ccf59b
SHA1 365e7aa0b912bbc14bbf3b3455246df04036d049
SHA512 a4b4d08db048ac1afb5186102150a00f32f4cc6ff54882cea80b4a0fecf256d8e250c002a659e2b4b05192290f74cf8ae885c6cf879a9b6e09c3fcbaa0fba69b
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEysy10Lle:eY8Od/HEnFhWvFvmXu1jawt10Lm2NurB
TLSH
T1FAF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4038363693bf243311292b14d7649f15a336b393cae61be0f42fff6c67f6dd80
MD5 c17bce8ae1cc118563a9ee80128f0068
SHA1 dffad13abb94be352cb4f0d159b87c9fd7fb5386
SHA512 e85ae6b8d505fe485da910f24d185e1f65fcfaf11950235c5b894432dde12e2e6259e65f32ea9eb4b757afc427ea0926b5d78e472a8bc389b7f3eef65f2a5640
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGJ:05ppxnY753RNBvRJJdt7p5J91dX1
TLSH
T193B27C5A703E0212397E3988B39696364F4135A37058E4AF7FB814A54F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.18\data.txt
Size 150KB
SHA256 5f26dcaf93bdd5d99e3f6f8266c06378a2855b74daf896788becd9c3f8f47799
MD5 6465a9ebed80863ed27fef7a65fceba8
SHA1 d950817d5f1c64daf8d7eb834c5dfc3384f9ff78
SHA512 e88e87a5f4d5afbcc5fbb867e640f94d3b4aa0a435e1c79056ac54fa221ba12fe094cf5290e86e76033cf0965aac56a2a24fe5db38fc56d3f74526a3e9baa451
SSDEEP 3072:aPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhpu4aQDo6j+UJ9:WX1aI5aZoKzMJ07Nh+QDoE
TLSH
T102E3021089C44FD9DFAC292C50BE0F1D53E1C69E842B6986D763FD4EBF9BA0496270D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 85df519707da9081d023397f9d218184531b144055d5f04ba47ccc142be11f11
MD5 fe8772d8e807148beb48c108f0c76536
SHA1 881c6ae4bb93801c06d800552cc7f52bc31e4c75
SHA512 00c2124948177a2e6c17e546428f8c4e34db47982b59cdc9f77afdb2fe9e965c96e651012dcc80dd0776d72de86eafd264192953a5bcc930b66fdbc983b2467f
SSDEEP 384:npPiFiZcIn3sNo8TUNTUlI4jQckCrCdpphiftGWE3jYYrpQOObjI9G6w7xmty/7v:paFQn3lwgokvXoGWOD+29M9
TLSH
T138D25C36ECA4DAB7EDFB4F95B7493A07AEE0517386DC4AC4D9D98E4C00930AD0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 633562f5f017e76b197e63d00fbb7d033d50b43974e121052e21e861a78b21ef
MD5 9f11b58474adb8e76184891e59d2077b
SHA1 1ba104f4473a01c51d7a02bff2107bc3c7271b9c
SHA512 cbbeb3ec41aa7625c3e7afcee54f645fac7715bfeeea31e5c0058ae6b5bd00beedc0371ee0e81443a14a11f2caf0b3a0a9e5a71f8350f5cb669dd7d6d4ef64c5
SSDEEP 384:npPiF9CcmyWC53sNo8TUNTUlI4nQckCrtdpphiftGWE3jYYrpQlAty/7Ig/O:paFccp53lwgKk2XoGWOD+ljO
TLSH
T140B23A36ECA8DAB7ECFB4F89B74A7603DEE0516385D85AD4DAD84E4C00971DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ce7e484c37dbc049fe300fc5827d98fa841b7116ebeae3ea3b92a707589ecce4
MD5 fac06effdc5a8821a4035eb97ceb1296
SHA1 ab966a2707635c2b8a4442ac2eb16b67b7b55e2e
SHA512 0a8898f66f494be5a1d19689b0a122c69e071133d5566b882c05ebdaf494b9b3ebef72d6962ff13967535aea7e3a7c1f3e83e4459298d133e6f1570d18dc41fb
SSDEEP 384:npfiF9CcmyWCs3sNM8TUNTUlIm2QckCr98l6phiftGWE3jYErpQe4KV8p0xHDty0:pqFccps31wgbkUEUoGWOJ+I8p0hvV
TLSH
T1FBC26C36ECA8DABBECE74F89B74A7607DEE0517785D85AD4DAD84D4C00971EC030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dcadf7f75b59fc337d897bda240b7f13696f7faed5999e3bd80119c8c05ba40d
MD5 c526020bee6866f2a909abdc618f4eab
SHA1 f0bd48dddc6bc8c83d3d700a1c5f41b56924b5fe
SHA512 453193c69306fc84139de956a5450faf9127613b91c607bf2300f8cac4af979e13483e2e91ab6c88c4cacd9134103ba4858cb7d07ce88032f1496bffaec8e1f7
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9lmKphiftGWE3jyvphe4KV8p0xHDty/8:puFccps35wgbkU4koGWOW7I8p0hvV
TLSH
T160B26C36EC68DABBECE74F99B74A7A07DEE0527785985AD4CAD84D4C009719C030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 41bcd66f630bce7ee1400bba400ddc82dc3b546bd68f70f9c8fe62aea39e0f8b
MD5 2a60e3a0c1aaea1f79541cb5cde9d260
SHA1 aaa0761a58dd12bd569cc076bd776ad5619e3f91
SHA512 94633ccbbe82382054ff7bc2364add361abef72be13a9d19187a4963db909d38e6499b971be33c2225fbb3ab9d4f1aadc1653b152727b766229f088c528ebb8d
SSDEEP 384:n0iFiZcIn3sNo8TUNTUlI4jQckCrCdpphiftGWE3jYYrpQOObjI9G6w7xmty/7Ik:PFQn3lwgokvXoGWOD+29M9
TLSH
T184D25C36ECA4DAB7EDFB4F95B7493A07AEE0517386DC4AC4D9D98E4C00930AD0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a94a4addda44d718e737b3b51b56bc06dadf24ad286c599019ef21c1aa6cf630
MD5 576f0431f8236d6f116279d40f3f0b53
SHA1 4f66fc24b1f11da6f40e76bc15c5271a71d43a9b
SHA512 5b4cc7fb612833492562f73d4ae666bc656450650c2ba9ed949e1416b79d4828e3e85522dbb686026c835af4567c74d575b75ec141e83d42c2df2a1aaf6d22ab
SSDEEP 384:nbiFiZcINt3sNo8TUNTUlI4jQckCrCOpphiftGWE3jY1rpQOObjI9G6w7xmty/7v:2FQT3lwgokcXoGWO0+29M9
TLSH
T18AF291F698E78A76D8AE4B87677D2E029EFCD163B5984584B7D84D4CCC820BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 14f35ec7b58aed84db5865e482d1758b3ab8f73734f321dc1dfe70f8d6c41133
MD5 1e87c35fd0979dc081ee539945000f40
SHA1 7288cd61033108306bf372e20c3809496f3622fc
SHA512 b1d850e81f53efb8feabfffe937863acd33910ecf4c4c7f8bb2ad0323cd78b870a8330a459fee91325b82c0bc79a6d862d81133f717d03fb7345a671671a0a75
TLSH
T1854141D15C381AE2C4BD0EBEB49739FC85E8D725F1A0347D6898EA940B7D94E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ab1b87c1e625db2cedaeea5e977d771d32cbb47dfac85aa436bca73f9ed40f4
MD5 77dca84069af9e48200c71fedcc4d7d4
SHA1 3ef2db6f147d22dcb8de0a6a1210b6afc91a2b0c
SHA512 cff5362f3ddd650d64548e7d2da125ca5dad5b10c805181f91d9364d914bb058928970bc59fc2a9602a5f434bbe59f7a532cd86dc5f3e344d4062c4be0369d00
TLSH
T16E4121D15C385AD2C4BD0E7EB4DB38FC85E8D625F2E0307E6858EA944A7DA4E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 825b1cff13e514d8e19b502911a6013a3ac3cbb51b6041e305fb17bc622040ea
MD5 054c801ac3d4d17afbeebcc0acca937f
SHA1 1fbeb6b3edd2eeb8b3850fd0f1945528a5b9d889
SHA512 fb677299aa80b744acd6c41ae0115a1635afa9a4493f568d6519def18c13667f8b46d1171e9a92c62ee70d22f769384b9bac7c8427e60d3d01868b39436597d1
TLSH
T1F74134D14C385AD2C4FD0E7EB4D738FC84E8D729F5E0347A2898EA94466DA4E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 577b7f264ce3f6e22d191f91f719741088fb23700a11cdccd4eea7eef0d01740
MD5 09dde066e88ed977643a92fa8b371551
SHA1 56bb7d2dac1c46c634602926111455e3fd0a8445
SHA512 7046fccff19219e70122a7c479c384b6bafc201bdbb4029849fa0ea5f2c825f090190bc5c1a9db7930a0d9bea48ba3fd17f2ccc4f6a3458b8b2dda3310d1132b
TLSH
T1AC410958A6E91108B3B3BE5A9BF6B86D087EB8332F07D49D10110E4E0A27E45DCA1777
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6116-174-0x00000231441B0000-0x00000231451B0000-memory.dmp

Download