0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lkputamajaya.net/application/index.html
Size 131B
Sample260808-eth4ratsbz
SHA256 0ee6dff170c38f66cc1e9ef00cfb927bba75b30379af3281c026647c068a4709
MD5 c92aa5f16d78423a983a5d7ae44428e4
SHA1 ddabaf1127fe57f9c65e2cc83cd3443f4efe5caf
SHA512 e6da7a7c4f00aa43d6683d254b31b19b63be2c5110de15aa27e2865499dc7cbac356055f6bab38ebed326e90b2157f295eb231b89e1a1da8d3990278b5133df3
TLSH
T1DEC02B4B310D1044036363801AC43760314303C040C309C40F87D113880051EC4C704C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3168	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306360769802440"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{F948362F-5769-4C96-A7A4-4457393F76C3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4960	3424	msedge.exe	82
PID 3424 wrote to memory of 3168	3424	msedge.exe	83
PID 3424 wrote to memory of 3916	3424	msedge.exe	84
PID 3424 wrote to memory of 3916	3424	msedge.exe	84
PID 3424 wrote to memory of 3916	3424	msedge.exe	84
PID 3424 wrote to memory of 3792	3424	msedge.exe	86
PID 3424 wrote to memory of 3792	3424	msedge.exe	86
PID 3424 wrote to memory of 3452	3424	msedge.exe	87
PID 3424 wrote to memory of 3452	3424	msedge.exe	87
PID 3424 wrote to memory of 3452	3424	msedge.exe	87
PID 3424 wrote to memory of 3116	3424	msedge.exe	88
PID 3424 wrote to memory of 3116	3424	msedge.exe	88
PID 3424 wrote to memory of 3116	3424	msedge.exe	88
PID 3424 wrote to memory of 3016	3424	msedge.exe	89
PID 3424 wrote to memory of 3016	3424	msedge.exe	89
PID 3424 wrote to memory of 3016	3424	msedge.exe	89
PID 3424 wrote to memory of 2096	3424	msedge.exe	90
PID 3424 wrote to memory of 2096	3424	msedge.exe	90
PID 3424 wrote to memory of 2096	3424	msedge.exe	90
PID 3424 wrote to memory of 4796	3424	msedge.exe	98
PID 3424 wrote to memory of 4296	3424	msedge.exe	99
PID 3424 wrote to memory of 4796	3424	msedge.exe	98
PID 3424 wrote to memory of 4296	3424	msedge.exe	99
PID 3424 wrote to memory of 4352	3424	msedge.exe	101
PID 3424 wrote to memory of 4228	3424	msedge.exe	106
PID 3424 wrote to memory of 5096	3424	msedge.exe	107
PID 3424 wrote to memory of 3060	3424	msedge.exe	108
PID 3424 wrote to memory of 2300	3424	msedge.exe	118
PID 3424 wrote to memory of 2300	3424	msedge.exe	118
PID 3424 wrote to memory of 4544	3424	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\lkputamajaya.net\application\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffc4bc9c188,0x7ffc4bc9c194,0x7ffc4bc9c1a0
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,10104927817037423247,16539299617166311725,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,5815769497451607177,12283979811003077207,262144 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,15288065688306852723,16595343974212291746,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,1143969024855606493,798468316917333479,2097152 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,2384258317598551948,13820352516491544252,2097152 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,3524575418866889710,10346084757357161888,2097152 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17921035972252918958,6985854122622956910,2097152 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,17181031398528221456,4223316520301293553,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16720753402936008973,9238359751435397352,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15943418983626270925,17299103563072481581,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15943418983626270925,17299103563072481581,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1188888290862044683,8627900402013770157,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,16472444419170020918,305817373388019874,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,13939616010403110297,9602327609849610982,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1004,i,18221624247761347250,16333795141659724438,524288 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5440,i,3021909257965581401,15359803148732382363,262144 --field-trial-handle=2252,i,15381877844661291682,11173662781981772573,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b7d52c3168471408dc836b52faa9b9e8df21fdfc2129fbd012e0534fa21198b5
MD5 8c7d79e7e41a6945e26a6e5b59f263e3
SHA1 30dd3d8cc102ef6ccf3dd5f01fb81e4ffae31fad
SHA512 6fa239ca27ca2d8d7c21196e8138ac9fc6a334552c90783e558dead0dbff9245a0c0f86735166cc22081d2c6c1997e8b045be078dac2283e2a401bfab01a2be4
TLSH
T19561E638092E0471E39A28B556D5320730B6BDEBF9561E74C2E09E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b64b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b64b.TMP
Size 3KB
SHA256 c813fe3837c55ae063b5d8c8b1045fd04ab09df0ce540007382d035b476e86d2
MD5 b2d0a7086cf3bceab93cc2587e868390
SHA1 9b19f4a6427cd3439ff00222cd4519712f67ba7e
SHA512 bd8486744eea6aaf3a7fcc39676c9d81519330be77cd92473bb262e8ee818266761fd34ab16cf69edcbadeb4a6d91e6ebe193ae99f36b71b8dd183246994bf2d
TLSH
T1AC61E5380A2E0871E39A28F156D5320720B6BDEBFA561E75C2E49E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e44ddbb7780bc5ec2b944d18456408e928d20b04ee2a829e7452b057d9704f34
MD5 20bb7f15e7a7b145f678a05f6b16a0ff
SHA1 deb0c8b4d39892decc6c7099a461ab1bf722aa6b
SHA512 781b31d8bb87cabdbe5d6afc2843d33d5406684497b39167fc4554a0c85256466c232385719f7f78f292d3928439603277669d20e6b3d6c6e8a98d6bd2b8d5b5
TLSH
T101117AB3C3D5856E891156F05A24AE2BCE2D0A06831C7C29C9D4FF6B93E3479E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f570320d93d1761fe800a2e611feda4bf22d9b7f8c073ac796a724145b1ca3de
MD5 170bc4feca4f9afd63b304cc67e05c52
SHA1 e8867a0a477c93e0965e1b771584044161045d17
SHA512 561702807eac6e67c086b3de0d50e733a0d156be4710e26f84dc9a01e84fd2c4eee8b26389491458217a03be6a00648f4529211dd56fa30708fb475edb286202
SSDEEP 192:sxZoReyM/jK1Ml8MkQ/fCsqhliIdpdWHW6+WNGY9IKkRiIgrJ:sxZo4MQ/fCsqhp8HbGI9
TLSH
T10942F8116A34A977CCDFD209FA557F53D6F80532A2900E58AAFCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c93d64a3bfa04e864d66ba716f98720b772a113d4c0bfe4a541333da0fbeab90
MD5 624cb952adeff917f8a20ec58bcb0c4b
SHA1 1af2f5b3edd652f6f65444505e1ab3dd7dbc18ef
SHA512 4257d9543ad8482e6d6ae923486ce1b7f7697d193655c4c7f16fe9c50ed424d341f867e5b4bd4be3cc98925bf51f71027feea46da6522680d03360cf110e9b2f
SSDEEP 192:sxZoReyM/jK1Ml8UQxkQ/fCsoJliIdpHWHW6+WNGY9IBPRiIg5xJ:sxZo4qCQ/fCsoJp2HbGCR
TLSH
T18B52E811AA389977CCDBD20DFA557F53D6F4047292900E58AAFCDA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e954fe830d163d2e5c9300361ae21bd7c8241f913f9aa2c7f7824a3213112938
MD5 581c5a852312563e6ec83bad7245d986
SHA1 e351db28ac98a47d5b2088cda6d9a8e8bef6334a
SHA512 2be9d0285b852f1b0971b2fbe7473e3c4d17be8253f975cff45d92c41545521877663dbf54761e5301924cc881a9c08ee2bb4b2661d5b4fa9349ca8d303f2775
SSDEEP 768:eDcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNtroeg6A:eDcv21wWvu+Z+u1jaeFLeRNGeQ
TLSH
T116D20B2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7c6af0a80fa56ef2f36af8a7267d468a66142fd77aa14119a4ab66d3a1c7fc1e
MD5 400b989bf0b207d09cc408972ac11e3d
SHA1 cf73f6abd865667ec240b48af93aefa04de4deb4
SHA512 281a918185e8727003eadf96c7ef3986525e0afa5e123d101c67b69318a9b73ef7bd8da4a19511895de8728b0faac538dc17f01f728774b7c24ba3b833e1f69d
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqAoKRef6KcKDyCt:mTLqHPt
TLSH
T1C2916312313B1292787F6948A3528A368E4636A33818F57F7BB800B50F27E561DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1f9e33d-305b-4167-83c9-d4ff66945762.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1f9e33d-305b-4167-83c9-d4ff66945762.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3859f6c7-e7c6-43b4-ac99-4bd5e4ca9a53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3859f6c7-e7c6-43b4-ac99-4bd5e4ca9a53.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 604c46d6714f5157dd277cd5c3ed5c13a20690eaf3ec5a4e70b540a27a0b4115
MD5 fbbfda8599b3bb6561871fe2588f100b
SHA1 13015937d6a2c7ab790cd01aaecb678c39690b4c
SHA512 6b4f0ff3788ecbb0e1b23b769565c0837e0ae0eb63dc607b3c10b6295b426ab34be8417a2053ca4e8e4f47f424434913e7852c7682f0e687141bf2156bcf0855
SSDEEP 384:1ZcIhsNFQzzimLmGe+CMOfhTnTKwBODNZOCIKDu:NhhHmRkOfhTnewBKZO/B
TLSH
T14B927C72AC386C765EE6E144F94731139EF89173E2C52F94D6DD7F2C01EA698230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3f125b64ac3694ce7d122b15963c1df0ceb40f4ff99b2bf72b52557ab625230c
MD5 061639da95fb8a1b0f075dc15fd75972
SHA1 0d43b8cd90290aec6f0915e1eea62793e30b5dcd
SHA512 016f3fd76e2942f163337d529f45daa4ef6d11d56ef41f3605c26056f5db306a9deb2876271d1c3329f9fe9cd1d9a3e064b0b9b0ac425f6ea7a8603fd8c13b41
SSDEEP 384:MiFiZcIOzsNf8TUNTUlIlRzzimLmGe+CMOfqTnTKwBODNZOCIKDu:3FQOWwgXHmRkOfqTnewBKZO/B
TLSH
T134A26C729C689C7B9EE6AA44F94B31138EF841B3E5C56EA4E7DD6E1C01DB188130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 96466117922f3fbc559db8023e95dffc37b2dee087686ecdc2c88b6a6a1ae0d0
MD5 d71660dad62b9708cb1a21f9f266bdc4
SHA1 9cd0171d66163e4ff92eb570cf04c51c94dd391d
SHA512 a211d7b1b8a0c4d41ab23f89f887739f5dc07335d9dde615ee1c3d6c0e02e249af1dec864bdd03c274dca1e67de36c6e1b298a0bc06cd3c88ba835b9af8ea4b8
SSDEEP 192:JONVh6v+YLNQmiUy08gZh+CGlOdmuus5EU6:JON/6vz/+gZh+CMON2U6
TLSH
T13B02FA35BD682CAB9FF2AE45F58737175FA8113BE6912F80DAD82E1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ec3a57c96ef47446285fab22eb4db664002e20da7edcccb1fc14677bd805fa02
MD5 d5de3098486c8a05a6b850ca6ed6a3cd
SHA1 af4f5e4a3ab65eca264120653db6663f75ee0029
SHA512 1d25adb907091df471912a3a7fb9ae49464651abe4e9486ed19618fb5d1b8304eb7210f99a42c0932ca6f8ca327378867e537b399c1bc5b3174b0d4f3dd0d4c8
SSDEEP 192:CONY6v+YLfQmiUyq8gSh+CGlOdmche4CHTq0U6:CONY6vzNOgSh+CMOfWTU6
TLSH
T1D6121A35B8786C6B5EE3A544F48735135FA85137EA867F80D5DC3E1C02DF69C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b58def2dc2e5ad516c536504f3f81647f88c017cfa3d97566f69aa89ebf90e8a
MD5 7a5db89d0210dbe797db3e194f62527a
SHA1 4e20dcc386b5db28e1f27a6a1a6aa15ba42df3ed
SHA512 4890380c400f4b2f67436b409af2bcbfddedc88d4aee28eb1a4007e77a8db0333f7cf1e59f3019898b301f52f8a91c009c359a9b45e30baf91a1cf1f913b0ab1
SSDEEP 384:4ZcIhsNFRzzimLmGe+CMOfhTnTKwBODNZOCIKDu:GhSHmRkOfhTnewBKZO/B
TLSH
T198927C71AC386C765EE6E144F94731139EF89173E2C52F94D6DDBF2C01EA698230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e6eddab316631a6551194c68c93c048a8d879ca4bb56327fad7a6c958a0b6a63
MD5 17514142af98d96d63ac2824766cdd31
SHA1 cdb75f47cda7acfb495190f6de937a105e7ce8cc
SHA512 e4033698415368ef6d85dc330a3737843338d3bc5c8ce15686c311a124f08bb729f90b575873884a65e85e6e48e0ec5517e2ee7bf9d8d10b4573356940d83863
TLSH
T16841DB58B6FA1148B3B76E5AABF6A46D487FB8772F07D09E10110D4E0626A00D871B77
MD5 SHA1 SHA512 TLSH

Submit Download