32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium/Potassium.exe
Size 74.9MB
Sample260825-tp4bfswakd
SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
MD5 eeb010dec5e5c64d818ab2a9eda690e8
SHA1 fa4e3666ed480fa2308b320d563c6b813c1cedc9
SHA512 31022291d211e966136617ca868e75819c2094c3f611377a7c0617c1caadf4b28d54a6fe01772aae64136cfbd4ad1204cef648297446e5b2615aaad2511a8e5b
SSDEEP 196608:c9dnSC56xrIHs2XTWMrd0mzO9dnSC5ZudFcc+/m4hvmS:c9dnSC56xcHs2aMZK9dnSC5Zg+/TRd
TLSH
T1FC0808F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4204	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4204_182059855\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_722512824\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1881023723\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1881023723\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_291722880\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_291722880\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_291722880\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1486425324\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1881023723\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1466279150\_locales\iw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1956	msedge.exe
436	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321481681848139"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{9080EACE-0ACD-4562-84DC-FA987E272559}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 5056	4144	Potassium.exe	79
PID 5056 wrote to memory of 956	5056	msedge.exe	80
PID 5056 wrote to memory of 5216	5056	msedge.exe	81
PID 5056 wrote to memory of 1956	5056	msedge.exe	82
PID 5056 wrote to memory of 5216	5056	msedge.exe	81
PID 5056 wrote to memory of 5216	5056	msedge.exe	81
PID 5056 wrote to memory of 5960	5056	msedge.exe	83
PID 5056 wrote to memory of 5960	5056	msedge.exe	83
PID 5056 wrote to memory of 5676	5056	msedge.exe	84
PID 5056 wrote to memory of 5676	5056	msedge.exe	84
PID 5056 wrote to memory of 5676	5056	msedge.exe	84
PID 5056 wrote to memory of 4036	5056	msedge.exe	85
PID 5056 wrote to memory of 4036	5056	msedge.exe	85
PID 5056 wrote to memory of 4036	5056	msedge.exe	85
PID 5056 wrote to memory of 3252	5056	msedge.exe	88
PID 5056 wrote to memory of 3252	5056	msedge.exe	88
PID 5056 wrote to memory of 3252	5056	msedge.exe	88
PID 5056 wrote to memory of 4204	5056	msedge.exe	89
PID 4204 wrote to memory of 4236	4204	msedge.exe	90
PID 4204 wrote to memory of 436	4204	msedge.exe	91
PID 4204 wrote to memory of 5020	4204	msedge.exe	92
PID 4204 wrote to memory of 5020	4204	msedge.exe	92
PID 4204 wrote to memory of 5020	4204	msedge.exe	92
PID 4204 wrote to memory of 3116	4204	msedge.exe	93
PID 4204 wrote to memory of 3116	4204	msedge.exe	93
PID 4204 wrote to memory of 3264	4204	msedge.exe	96
PID 4204 wrote to memory of 2236	4204	msedge.exe	99
PID 4204 wrote to memory of 5384	4204	msedge.exe	100
PID 4204 wrote to memory of 4812	4204	msedge.exe	101
PID 4204 wrote to memory of 3932	4204	msedge.exe	102
PID 4204 wrote to memory of 3932	4204	msedge.exe	102
PID 4204 wrote to memory of 5072	4204	msedge.exe	103
PID 4204 wrote to memory of 5072	4204	msedge.exe	103
PID 4204 wrote to memory of 1652	4204	msedge.exe	105
PID 4204 wrote to memory of 1652	4204	msedge.exe	105
PID 4204 wrote to memory of 692	4204	msedge.exe	106
PID 4204 wrote to memory of 692	4204	msedge.exe	106
PID 4204 wrote to memory of 2004	4204	msedge.exe	107
PID 4204 wrote to memory of 2004	4204	msedge.exe	107
PID 4204 wrote to memory of 860	4204	msedge.exe	108
PID 4204 wrote to memory of 860	4204	msedge.exe	108
PID 4204 wrote to memory of 1200	4204	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\Potassium\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium\Potassium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.AspNetCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffb6dd4c188,0x7ffb6dd4c194,0x7ffb6dd4c1a0
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,6918634136491795960,17421882098263260073,262144 --field-trial-handle=2136,i,7033159181433536776,9819043405679313246,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,14613880523737322995,10184541907593956429,524288 --field-trial-handle=2136,i,7033159181433536776,9819043405679313246,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,5042751086416816353,6817266923217157593,524288 --field-trial-handle=2136,i,7033159181433536776,9819043405679313246,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,1184390589657302117,15772059664808630954,2097152 --field-trial-handle=2136,i,7033159181433536776,9819043405679313246,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,11616421368938869088,10577991943577566754,2097152 --field-trial-handle=2136,i,7033159181433536776,9819043405679313246,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4972,i,3451102257665300640,13068462853963135948,2097152 --field-trial-handle=2136,i,7033159181433536776,9819043405679313246,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffb6dd4c188,0x7ffb6dd4c194,0x7ffb6dd4c1a0
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,11086659649341115662,1472640661085850701,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
      4⤵
      System Time Discovery
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,15046884294179870971,3984668928699686139,262144 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,5814825467152233096,14422315692562976051,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8645336613600689472,17638381124324008834,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8645336613600689472,17638381124324008834,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,10481948481973775939,14383636913787116003,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16945221999509889554,607820261641783038,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,6226554207925713357,17114358938808351407,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,12321723775313884741,5850567800042991986,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:14
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,8142443216466827543,9663049596222105529,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:14
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,4790948928483212206,8729435289428830638,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,2179184461120751664,15791338409573420922,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,3233973556458494652,231265460618128637,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,12002546994289340427,15183430903911299337,524288 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4876,i,7504604707203225471,13925465117137939273,262144 --field-trial-handle=2160,i,9281101648620599592,12362411409139330149,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1b088d9e84e9d3c7b0640140ebcb279272e8bbc10bcf528807a7d61de9d5085f
MD5 88fa71e260d7ed39013eb30fc44285ca
SHA1 5ea3c7da493a4bbce1fdeb693d88b2d8336b7fbb
SHA512 143c43149d5e80dccb2f89687a65ce334340054df7eac721378b84c480fbeae5e9f6b02bef8897cd906675a07d4928dd5bf7b0836d09981581773c25d7286073
TLSH
T192D0A72629297493E32952759191C703325A15725953A201A204C81C9D784D2A6D59C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0d9bbd2518187f7a92711145b99d75cbad2e968c20c4abd77b2ae7c002d52906
MD5 7a76ad8d0498b56bda94a84547adcb33
SHA1 4ec3dfc633d6559cf5db9e385e71e58596220efb
SHA512 2126778b6d09c01af7561ea775ec33bc5d64cf4d22397264fd1cf123faa820aaf0791c90c0cb51f5c304086844bdd92c1ca75f02eae2ffd29caa5921876e9a23
TLSH
T121E02BAAC824ED2719F90B1DA0651A4BEB5113571680945F3A3E861C8FB672A06CA81C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 54d7b7694b864fca0710ed35e7b354dc91874c71d5c845e80f008d220dcbb668
MD5 be4083215adfe34f5aaef56945631b7a
SHA1 b9f77ad11b550ef543d65dff44c65f087c85282b
SHA512 ef5b0b3a1703ef74f50b37cce1c4f9932d5993266122d15942fba8a05e6c2105c1deb2258ea4aa2d3a8b8579e4d48d83a32454f4b38722d8509cb7091c9ec73b
SSDEEP 384:5P8knwqbBf/1yUJJmgryb5dnGJVZ/bjEjs7V8BpubERNq7DWr:5M0f/1yUJbre/nGJVZDjEjVaERks
TLSH
T1D913C33E32954E47DAC7153C192F1A3A177CDD60E6C4BB3733B1714A4B0EB4AA98E609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 762a168ff66b7130d7e111ce26c477b9956871dbff9a7acedcaa3fa250530639
MD5 a330cb8836623679685e650441a88eac
SHA1 555b16764a612cec7d4ce3407659714c8c020547
SHA512 afe0a038ea9049a26d574216bb07a71f338a02148dcbad3ad0bb3afac617e318c9bd8800690a13a873896a658596a8ec7f0c67a522b58da454c64df70684c42c
SSDEEP 3072:rL/jL/+5gWaRLBzdzY7L/pPL/JMkC+1nMJw67:rL/jL/+5gWaRFzdzY7L/9L/JLyw6
TLSH
T11C446FF75851A01BCFA802F5E2033A3DD17B055D7DE1F9E9E5780C852829F22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 7d799bbc8f148ee1e1ae8a6c2d5cd25ef402606cbd582e526e22d85d8aa46f22
MD5 5795e33ad451d83e00ca01d3a49bd1b0
SHA1 0cd0628b3312385a26832d1c12ec622fe621cfbf
SHA512 3a4735618f97fa2da9f2e745d5837fa89f72c554dab5d6ed990e94c16cb3edc107df304b0e1dfe8441e0a8cad241b70bf14c7c831c914fcf6752b70d4c271e24
SSDEEP 3072:Dc9mZH74kuACH0ZWrvWPSvrLWp7tcjFvY5mHYzXClbrZa:yml4ZNhHrLuSjFw5YmEZa
TLSH
T1BB2518EECB682C82CA6B8774B0E0D9077E712183B68DC0D39944C5D997D6B8175F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 72b1d8c9e8b627eec398fcf8f3e9a5167980607d0291ef8debe8aaaf0ffe8e95
MD5 a6f1637d7bc87222231d008a0b66a942
SHA1 c13f7ccba7ced1fbc7082150bb75f5f379552a20
SHA512 e1edb9d0908b44216c41fd3242775239c9870eb582b20fd102a8275e8d3352f5179fcc10bb26ac3cca0b2ef2b336ab9a935707e861d18f25d919920e11c85732
SSDEEP 24576:JolmYdn7ST7vfXGOmoFgIXWhEAVuF44J5PiCV9yNrKyNG+9tGDl00MffY6qfiD:1YpeT72ivXqVuF44XiLb9tMlBM3Y6qq
TLSH
T1BA866DEDCA6898C3CD639970B0F0E9477C7453C3F994C1D6889CC584026BBC5BBAB669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b27bd932d59dd35a67366bbe203dbcf9b9c5caa2f438a2b2af915875988a8be9
MD5 436777023963482e1d26216889687a2f
SHA1 e3a148ed17b63887091e2b1fd3cd869af441933f
SHA512 74b292b7f308718a85c6ed27b7e9a49771312530ae25b3bc8c4470195493bc2dc569ca887421d176ecf991ee55ea26e2b5ef12192bf5a3f82e89337b5740840c
TLSH
T1EB713DFE3A7165D3F319223092D01102B7E048503D47BD661F4848B9FA3A790D2C6EC7
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 819e77dc31a90325451decd7ea24690f319f2f6f93738cf0262470e13114357c
MD5 4214b5128e78612ae3d8127811571e20
SHA1 90708e4918ad856f1853a0180bb423e7e695afb8
SHA512 5f484d863a612102a185ddbcc5a9218d8a426d15c49a6a57c80a1f45e87d6bbb2149718fa13b86328718b21f848488a81f689215eb75ea44f6de243104f84049
TLSH
T138E020D454C7C11F5A9D34C751686B1CC3C03593D785AD131B01CCC4F657402F341546
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 de64d5a71d4c4acaaf4a263d10a572a066971e577e34d47d69e171e7cb4cb62a
MD5 be8002cc3c20a4c91c76b4ee0c27f72d
SHA1 9f1a7c28fb7cbc198b010e3e970bb3ed9a00028e
SHA512 3faa3d2a76b2e792430e285e3ed3c9b5e17869e92af76f98b8a571ff825f89908ae7e90ab65a94112cc393d7c341848fdcf10d9fd40a0bf94127fefc851b33a2
TLSH
T1D4E0865434C9C12B96997893836C6308C3E13697A799BD16670B88447113749A3A6384
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 206523361d15b02317547f120ab370342bfc40011fe158bf856854aa6d828242
MD5 d45e662f4a78140ed101a00a031b7bca
SHA1 2aa38920812269bb6d04be54d981eee33e71f386
SHA512 96f675827d21df980c72886fca058007d2bb850167e785aebd5183a20198218073d45815a4e89539e5b598be54091c4ced6f4fb724557fff114deeea5c102d24
SSDEEP 384:RQwY3n8a83uFBBQ1GkSymE53Rv7DNspU0:WPBFBBlyR4U0
TLSH
T13414220F5F302612CD7C523669EA54A35DBDF03BCB53A6CA6C6154B0CEE3652A02C5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 bfcc62b2b2572677185d1410f029591c088248d52ef20cb781f6b37b74902160
MD5 b187ea673b255f88ddea912fab2031e5
SHA1 a980b2d3cea66b0569059a56640091854ed29363
SHA512 6fe108b00972cbe94945a3a0677656d236094271cb553cce66efc3f3fba78a49ad6ade2f3821e3e12fb0e36bfbf89d1f450584621734e09f895b321da46a1c87
SSDEEP 3:YclllWll/lFlljq7A/mhWJFuQ3uGWUAGlllnotdwenqFtjE9SFcTpJWaV1vGrV9k:YUllWHE7lGZ/l4d4FS99pJB1eBG
TLSH
T1E702808106A099BBEC08973D92CF40DC9FB33D4C4551CC11810CCC550F045CCC28445F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 81ffb6c32870ff76d5f5b4abc1a5d1e59ab3b0fcc7608d89f279791a9660b227
MD5 1cd0cbfe37069f29fae6a93b029b1f60
SHA1 485ef75ae42eb52fdc7a745c95d6bd39985e97b3
SHA512 03e4466f48ce27c50bdaeee424ef5ff4cbfae58884a402f5075456ddce58b0ef39f07b2c4b86db16253a02259b840a0b2be0594a3b7b0fa6e4f1f64951a27b6a
TLSH
T1DEE0206454CDC25F59C8308F521D7F0CC3B0375AF789BEC12B06984EB052004A3B11C3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 1ebfbe80c367b0add181e19707011f4761c996c3c8d84ff466276a3129a8dc41
MD5 e9734037e3f150af11038bf9eb02e7a3
SHA1 5178bb3c7a6eddf2661c14597700adda94a0779b
SHA512 3732d68a4094acd0acea2edb7ca64d1a44108fbd4d6cc9a7bccf392e6235f1a08f901c100ce2218f7fe83e4c396d06dfc94e54d1b00bb0fa50acbb7d1e397f64
SSDEEP 48:T2SLopFMatSaw/auUOt8BzWFGEvGOikB3MjoZaAV8TP9hTRP+ohwR2MJ3v7XwGi7:iSeMatUaAK6cEv4k6swzbTRFc1v7XG7P
TLSH
T11392734E2F3021A1C1A51F37DDD1CA162E3D201A93F376589949E0B28D62ADFF60659B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ecc8994d9ae8773ec186a5cb7432460b2cf1225605c78cfee9b2e5b1b2e8ef42
MD5 b6bb85741d5c78e70a33ef4a78b9c432
SHA1 06895ffd2dbfc43ff56080a8a9be3444f76d9e7e
SHA512 25e7bcff309b4b1a0e2055d8d9e256f44ae2862dd634b6c48d48cc73f202182cfd846dc3ef19cd460e3fefe72e35356dd2c6a176094a73d041c610607ae9be4a
TLSH
T15E51AFF783B4856ECA0195F0AA18AE2FDE2C0511431C7C5A85E0EE27D3E3471E04565B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bfbe1af4f773bb73a39ad1b1ae09ede75972c96d976e5ce0288b38850558b8e9
MD5 175931e2cafbeb5aeffa37cb87d907c4
SHA1 228d0ee3390a0a548cbf94508840602e29e60903
SHA512 df101731f79aab0bd93f738c1ba57f77a117f26a6fef96f3878d6408881cfbbaf8dfa11efcbf5fd2eae671e7222959472e40e3f8ec174567ed263c0799587271
TLSH
T11E418EF743B4856EDA11D6F0AA18EE2FDF2D0211431C7CA985E0AE27D3E3472E00665B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 0e796aa87ae329a3209625a4b8e85f468211d54be43110c9dbbd8c2850a37f7a
MD5 ee6d62569e9d2d499110623a3f732da1
SHA1 7033f5ac072666d57ab96053e2584bed4799e535
SHA512 7dcc3938ff5f5620fcb0706b08513ab264133c6392a95b1e01dd29e95f359722f84e236050016d1ab99662b7a50490da84118124a14f091877cde356b80ef5a6
SSDEEP 96:uIEumQv8m1ccnvS6IWsX2MkGf5nFXTw1Tn4g:uIEumQv8m1ccnvS6IXXTwL
TLSH
T143F2DFFA07276205D98444F0E4006F8FAF16400B47B6B2DC76D447E3F7A21E2B2B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 f1188f959fe48aad76df838424c38cd81a9716003ababcaa8ec5175a7ade499d
MD5 ddc1df629ca218050c47728b7f45627c
SHA1 a4145c648061f1628dda345bbbcb84c3426f06d3
SHA512 f34e4ec2fe4104a2eab1d6baff54df992543a7f4b6f74eb24372262bedc86da6efef36bdaed02b277d17a6ff4627d2c277a11f628d476ce3171c79e62e197123
TLSH
T106114C67D5FEB86720E818EA0A14FD467D3AE031814198FADAA796BCB0764F71F01032
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cb2e20859808067f932ff4f2de29252aaa7694b49fd778eb2e2c4a5fdcb1b91b
MD5 3f14158f8fde7336d3e5010523364604
SHA1 2672fc4d165afc74175b29f51ca2753ecec80647
SHA512 880073cc72486a67631db595f3b75b540c060bed48a669ccbae43d902423f6b5fbb1b481cb183f617d5aae6e38c3e290341218d552c6def89b939d9aed7ad88f
SSDEEP 384:sxZMClgN/f1sJWv10T60Ly8j+/bS/5ekbP:slmN/f4Y10204/bo5F
TLSH
T18872F806AA38597B8CD7D309FA457F63D3F9142691915E44A9FCCE1C00E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c937aa0dabbabcb38d5b7fcdac02ce3f5eeb65c3eae4b3ca421df98390136ec2
MD5 d5c0d67c818c6bf5d44eea55557ca9ab
SHA1 e142920ba90ee2187e7e447f18245f36edf3ac3c
SHA512 348c3d785cfa091cc01383f27be3bc5db3b3df4785c4cdbbc600985f96c05eaa60c0c1f3246e34556893e0436096283e4a0692a2e28a1fa41be9f87a0cee475d
SSDEEP 192:sxZMCRiyMqZjK1Ml8MNN/f1s8j03jxE0CXUyynDAzodp5Y/W6+WNrvb/Y0d5WVNL:sxZMCl1N/f1s8j0T60Ly8j+/bv/52LjP
TLSH
T16862E806AA38997B8CDBD309FA457F53D3F9156392515E4499FCCA0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 e7cf3eb01bfa41ac629dbb5a166f02a1761c60475e6582f72ab4b82a09d0e6e6
MD5 588481c9d920850f2d483937100dac42
SHA1 3b61838ff84cdc92962c7875b938ab004f32eb3d
SHA512 ca30f70238429687e4d5f4c1038051a84afcd0af08273813a5680cc08b09f6adffdbff3b8a8c8a859dba58dc251e35fe2fbff79cde47d7e3870e5c3b2b51ad95
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3t3pQLlz:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKt3pM
TLSH
T125030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d0eda51ce16784ab57bacbe09c46ff91653f389ee3a9dd59543da9ba755952e3
MD5 5addca7507a9bbb104dd1936892a73c5
SHA1 35f2e0e282bdb7a4865e6b36151e227676ce1240
SHA512 303d97457eeff8f7b836d4f4ddaf77fa3a26cec4074922c601f875d7c9df9d17892c26b03a4a64c71b831814e59317b56e05da6beb4c7d9a150202211bf82c89
TLSH
T176E0262045C8C17F66993083827C9708E3E4776BD6CCBE023F0AC8846183604B3A6280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 13eb2b0bbb7ee095cb0fb485c3aecb42f2bd8e8ad8b75cd0e7e966006ccffcd4
MD5 36b629f25fd41505e8799e2a9ec56f66
SHA1 7c1775ec577fb73a6645bbddbf0ee64255b2c4bc
SHA512 d3caa4dd0ce6fcaa8ccd00b992723a163190076db215980cc9c932661ff7096b681475d0225d98aa5411ea17e037eb6246f2ec63b996d6968e3c964c2fbc8d45
TLSH
T1D8E0D82015C9C23B62CD30879358E708D3A27653DADEEE313B0AE4C4A2471407367140
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 0816da6f3d9662f633667206984947428b9ea47f3e4ab9594360daafde409783
MD5 b300937495497cd1db0947c8c5250996
SHA1 e774d3acfbf260b4772c6d9b777a89b4359b0c49
SHA512 a2434d185b4567097b17d80eb4099ca0f47b73365bcefe5664a296ff4b0e7b465c170912c3243c8776c50e3c49f6388d908007e57b91b040e0ad6a5a1121595b
TLSH
T151E086B045CDC23B54CD70878369EF1CD3F07B569BDDBE5A67094484A142144B3BA580
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 f68c9f814bbedd7cb943eb62edf0a5eb8ed4fbab65580cbd571d6b6dfe3bc9bc
MD5 99a6b0b8e7114b27838707fce1cd7fc2
SHA1 9a242e4b9a8645637afd76b1d8edbcb6a44cb837
SHA512 cf841522d94230bca9e8dee9a992c70493bf4a7482face70c2f3e32f6f8bf02ff2c086d7fc714cfb4cbf3d6b7816f1a82f23306c8a0a1e12c0eb01c8fb47c8f1
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7A7UW:AFBHhTofhno2mBeaA7UW
TLSH
T169B29052717B12023C7E290CA7919B370F4272A33458A96F7BB900BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 ceb8e4a6847ea7750483831220615a49ea9d1fc2c4056dd230212159e17b2019
MD5 e6ec4e5296c5b0454f482ecab581e382
SHA1 5a69608339bde7bec805c1dc1084b4251858167f
SHA512 34bcd8b7cf9f3d6c1a6f930264b7eaa608ffd88277a88dfd6584460655cdd059ac306a8085d63bbb9638f48329cf0c9e5e42010a2c68b3517968c4169711feb7
SSDEEP 192:FvoWc7qFfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aH7sfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T15424530A7B747001DDE7D9725CB080771E3CB16ECF22A6915DA264698DB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 fafd4bc0a4f7cb6e0b0cb50164816c4fcf6fa67177e493f5f0c1dd4d59a48d9f
MD5 f03b4f47bd4850aea9425f0e7d9b60a2
SHA1 24dc5ffbd497b2d6b5b32909747d31148e8c6ed2
SHA512 256b6376156670f21e008f6f186ed0a1c0407cd1ea9c71958f4599f90f9ed531a3a8b2b350eecd677d9afe6bcc3add575c32e8310bcde87a835f249ff1c3d883
SSDEEP 96:889+XzgxZWAQgOXQZeDWXWY1lDmTseCeAWVSl9HNvWWV20XLbBB5N:E+OWeAsSl9HNus20XL1B
TLSH
T1062220646E129F3BC42D6EF712F98F9003C2E442827666AD75A1089D0DD2727D7C82F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 2e88d14b121458b90f59f019ae115f06d7adebaafa8d05658deb0f456fd1d995
MD5 dcef980f364b1e9f6e7da357157bd313
SHA1 7c505f849014ad1f1d6f0a8c568eb734a07db36f
SHA512 8b7dd686f3d172eb2a52a7826fa1383271dbc547aa17bd0dff3dcc5c44550a48a15e09631ef13b3d6cf5a714dc6f91269d04256c86bffd2c1e9b31673df07af9
TLSH
T1A0E0805475CDC15F64A930C72178534CD3913777EB957D556F07C84861122447795251
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 df204d0303ff375baf1c3d758cfc19e5ad3f77d0f23f99b393f64af927b14420
MD5 5426587ce7cc563930500beac2b446a0
SHA1 495ab1c0abfa377eb075a5f58b1e6cad9566339c
SHA512 59e7c38ac8db403d14efce0707f294e333d98c16e588fb27654d0bcaa8c9a8bf2d7399c0d6c845f4463468530094a11158d4796e0faaf9b64b1e668f4dbd2695
TLSH
T1EA211C15F320C158E14A963DA02A9B291778E8168FBCEC1F55B920252D62F450E9B7F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 46cef08ceb6cad64470df9fe5c2151439532f1dbc3198f3431eaceaf7140af43
MD5 7a443fa0b1a9034aae932b33b565c1ec
SHA1 2bd887091ae8ab6c1c6ea472fe506f5ac66437a1
SHA512 953337069491cb53e769de0ab442d8f5385862f5a6ea78a2c523c0662a7057d8a09d3a915fcc831ccd1dd5039fd80c6076818c26d29d68f4637a561d2d06c395
TLSH
T197E0201464CCC15F60DD748B01699748C3D13A57EB947E052F06CC8851421457376141
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 1f75ff41e23a0cfcd124c2b7b290bfaac98f809b65a37b544c1cfcf62436c513
MD5 05d2c8bebb83e0067cc91065497bbbcf
SHA1 b70a8a65ac36e12df6218b7093e15e92e18e2d22
SHA512 31a697ae741833d91e73b0656d3decc774e84a6d0bdaca14bf107e5c1b542502024b7166848c515830c9ae90cdd0478f9f5a86a7bc4c80c34567cc06586f8d51
SSDEEP 3:MsEllllkEthXllkl2zEfllIZ3g/l:/M/xT02zPg
TLSH
T1AE4404457FC03507C54030304051C3503371F4104D1557533CD307335CC7540DC00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 83e5de1ad9b5e34be1463513d3b0df9973d0d1d65204556d98a3629b2445a457
MD5 35f231cbee88c31fc71a0f6234724913
SHA1 96ba65f8d77eb7bc97a9805b14bf045e75237466
SHA512 757ff5cc3ef55c48dbfbf4c17c6cadbd1d387966ac4e552f5c17cb2c7a5206d78acf712bb37d42de960c7c70f5fe3a5c76a9ecbf6d14c6c83b7dea6ab983d5fe
SSDEEP 384:n2iFLZcIG8NW8TUNTUlIRdy5R1jGfb7o130cKg+E0SVFH8g0cw3UF7Iz5Yop:dFTGdwgQEoZ0xgh0SVFH8g0cw3bYq
TLSH
T171C22936DC65CE7B98EBAF88A64E3603CDE40173D9AC8ED4DAC45E0C00A759D570BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 49b1ba1e9e5af936ab7596894a58033251fd46f1a6fee7ebc2c40774cfd6c38e
MD5 71314a046f2852eb19e6d60bba6e93c2
SHA1 b8a9d1a8bd289d34e0f735f5bc17fd0449521aed
SHA512 ee93a4540a4db4b5d43076e9dd2682f3d958214e01622e474360add3e5088e0d694071cd10922fb028c0ed5675b776e4f440ac0c78fd2012063da2143c6a2dec
SSDEEP 384:n5oiF9CcmyWCs38Nm8TUNTUlIxBydvQooajGfb7o130cKrbwLaJCra5eTQQIOHyS:RFccps3Vwgl/xoZ0xrbwLaArX3
TLSH
T12CB23A36DC58CAABEDE74F99E74E3603EEE41163959C9AD4DAD81E0C00971DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 db4b62f0e11904e7981e31d956ef8943d8d8a9b86084901d1c9ce3d83ab99200
MD5 c1a43124094661b80aa1bf3adbce5ad9
SHA1 75d4f6d9eca2168a5e516eb40b900639b97b11b4
SHA512 29d0cdd37b75dfd0f7a9b2e96b7744885f0c8e5e1339526a964c89b7d74c36c2c15888ca3c3aa36ed3b6ae489e45597104ba0f95256a10abe7d4d336f5d5538d
SSDEEP 384:n58iFoCcmyWCM8ND8TUNTUlIR9y5m1jGfb7o130cKzvBA8E/oT9vk+Q9k3UHy/76:JFLcpMUwgzEoZ0xj+8xT9Dgk3a
TLSH
T13EE23971D8548EEB98E6CAC8A24EB502ADE44233C58C999CE6F87D6D309F0FD4707C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 89621a9803f30d684c87c9b980f8b9582bd707427d66e3c477e072dd67dc8880
MD5 2691281791d5b4bd6e2a103f7d015d24
SHA1 866eaf17e365e1fbce0d05a227d396a1415a17e7
SHA512 2749057cd854f503c5969ee15acdfbc4fafc25b9a888d18b8806149f40ae0790a5f17a253000f270bda19bbbc511470be7e268c43013cd790c66090cb12c0e62
SSDEEP 384:n5LiF9CcmyWCs38NX8TUNTUlIxBydD52jGfb7o130cKzZ0WwLaJCra5eTQQIOHyS:0Fccps3kwgmdoZ0xlrwLaArX3
TLSH
T1C9C24B31DC58C9ABEDE78F99F74A3607DEE01163959C9AD4DAC85E0C008B1DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 1efb631bc4fa7fc1684f773490e85291dc8aced77dc0c3e1eb2484f01e9e14dd
MD5 89741578b4553d93b9d5f0c3cb9fdced
SHA1 4012175ed5043088049e4d11744726811b8de5f3
SHA512 87390d082c1113fb203dc576ca2d82dd2a4c88d49531f3f39ffc54f3afde054960649945a157434c033b053eeecbe13470240d29ce9f9a7ab8fe811e53f3561c
SSDEEP 384:n58iFoCcmyWCM8ND8TUNTUlIR9y5Z1jGfb7o130cKzvBA8E/oT9vk+Q9k3UHy/76:JFLcpMUwgkEoZ0xj+8xT9Dgk3a
TLSH
T1BCE23971D8548EEB98E6CAC8A24EB502ADE44233C58C999CE6F87D6D309F0FD4707C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c8307b81ffc057e6b98e6a78b02586038ae84c87567f854176b54f8c349bd0d6
MD5 5b2b9def67bcb131e9d4f737607155c9
SHA1 9cc43bb5765d6e229ceceea8c23001cf7301ed36
SHA512 1049a226305fe7ca11456e45dd84611b3e34cb324c6f8f05bbe0f027ce622ba33dceccabf52dd42933508ad28bfdbda47fe889d922792b6765f6ca58531c1aab
SSDEEP 384:n58iFLZcIG8NW8TUNTUlIRdy5R1jGfb7o130cKzl3Ck3UF7Iz5Yop:JFTGdwgQEoZ0xhSk3bYq
TLSH
T189B23A32DC69CEBBECEB8E99B64A7603DEF40063D99C9AD4D5C89D1C009759D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dd34c64698df61044c3e80e86a4a7f2d62726296af707db679c65c0fc7ebe2f5
MD5 dd30a0d770c3998de0fbb6ce45c98cfd
SHA1 17f4f13f3027d1210cb8567122f73c49f17b2b1e
SHA512 5d7bbeb536e6c7265a2e390cc7b7d86ca96df82030a410c923f45e5ccbbdf963d32dae0f8ff41d493417c6254ceaf164f4347d2097d4e50242ace51e9348fa0d
SSDEEP 384:nNiFLZcIG8NW8TUNTUlIRdy5R1jGfb7o130cKzl3Ck3UF7Iz5Yop:EFTGdwgQEoZ0xhSk3bYq
TLSH
T1A5B23A32DC69CEBBECEB8E99B64A7603DEF40063D89C9AD4D5C89D1C009759D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 fc030b97293aae2fe03544dcee906f62384a0f0e6ef48391814217951fd68bb6
MD5 cab34c582e61c204cc48b42d8ed81297
SHA1 73970dfb1793dad794849c2fe77b148b5301b6f5
SHA512 be31d4c2880bb164fc68a8b1e098ad0418eca3ba6e3b6b74dfafea5e69973c55e409e2b4c95ba4718d5c8fe86e4c26903036d57d887d0fe0dac06f7a6986aea5
SSDEEP 384:n58iF9CcmyWCs38ND8TUNTUlIR9y5N1jGfb7o130cKzv0Wk3UHy/7IgE:JFccps3UwgGEoZ0xjrk3a
TLSH
T121B22832EC69CABBEDE74E89F74E7603DEE41163C5988AD4DAC85D1C008B19D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d68ad9ab43d31787ff5edd027fa11af1a3a5a652e1e541dda9be7b02eeb29021
MD5 7c1cd632a93080f21c86590e239ee75f
SHA1 274fd9efb4cb118239e627e2e72d2567c30c0359
SHA512 6dd2b130f43776061f92849b03ce219c6449da2718a36ebb474d75e4db9901b64a4687d246bc27f28b0559d4a5acd75a5c40f95a8b3d6c2511284a001c5e4c64
SSDEEP 3:MsEllllkEthXllkl2zEfl4K//l:/M/xT02zVK1
TLSH
T1B34404C47FC4040FCD00153440D1C7513371F5101D15574334D105335CC75404C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c500627cab47211a9ef34c64c856048601adb0d5f20c827448c3ad26cd3bc584
MD5 add51b001aab7f33416894eaafec55bd
SHA1 359b83cd27c9dac6f7ad515f91edb9b85a83b76a
SHA512 3d1daecfd13b217777f1ae64ac9bee17e785684b6c04e9774118adbe2a38e30abb239cc303f68fa6b47f1ede07f01748342684f5adc00714ffdb760f4d76ca73
TLSH
T1B84152D04C3D0AD2D5BD0E7EB48738FC82EC9725F8A034386898E9985A7E21D309487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a676d28f37985572af58cb2ec6bad9d5da923eb0fdbc547a06799b87813ea2cb
MD5 f0d9462fa5e0debf7f0b330073d94175
SHA1 2c569da035f98e0e029e435a7931a7cc7caaa95d
SHA512 138180360a4b471e8f5d6d2d4c5a363f971c0c96d31a6728353d4b8afbdd7336031e2c7273fa3b94faf09f22c0b20dc2f1ba26110dee76fe69dc38fa1b41213b
TLSH
T1704141D04C3C1AC2D5BD0E6F748738FC82EC9725F4A035386898E9981A7A25D309487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3804abd25219202fc1d4fab6e5cff19055c3af44ce0e8074df4f46e6f58e2fc3
MD5 69df4a6c435725916fecc8df73021da9
SHA1 139829b5156e8b2a62743460c020a61f0705692d
SHA512 66581da303557f0e1488f02423cbc85375211f851cb932acfeaba48384e97e32cd8cd3765d83729c12e5f93815714dd4ff0cfaecd323ea3d790611773ba51b4d
TLSH
T1E5414FE05C3C1AC2D5BD0E6E748B38FC82ECC725F4A4353CA858E9991A7A25D308487F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

4789a35c-8d09-4690-b5ef-e2d22cfa64f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\4789a35c-8d09-4690-b5ef-e2d22cfa64f8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1486425324\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1881023723\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_291722880\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3264-350-0x00000224A2F60000-0x00000224A3F60000-memory.dmp

Download