a2f75b8d5d72d18225eb11cb6e17aa0ced2366943bca189e76c72aaf712d5af0

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Anime-Expeditions-Creams-Macro.html
Size 352KB
Sample260808-ar2e4aem6s
SHA256 a2f75b8d5d72d18225eb11cb6e17aa0ced2366943bca189e76c72aaf712d5af0
MD5 0ca2d03a366fd5fe279c061a400a07fb
SHA1 91f36668a08fbb1a46f44a5ec10eb3f53af981c9
SHA512 814695f988adf029e3eb1f6e1dd55f03f3958b3b8cbe2a7820fc6381a636a179dbc6c475dd47bc836e8bae1f00fadea76c9a463163df8d732be7a57b46318a86
SSDEEP 6144:ZSUuCC8M7kNUREMP82ZitwKl3p3ZWJ4X4j1crVGoZOy5uOawlslv9aySVPJpSrbL:EUuCC8M7+UREMP82ZitwKl3p3ZWJ4X4h
TLSH
T12074F9B1B0B4D23E064F165AF4706758D39AF28AD65A68E2D83FC2F482D3C84F7A3155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	camo.githubusercontent.com
34	camo.githubusercontent.com
38	camo.githubusercontent.com
39	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306224654138137"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{972A301C-9C38-45A4-BFF7-435D060F9355}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4660	1416	msedge.exe	84
PID 1416 wrote to memory of 1328	1416	msedge.exe	86
PID 1416 wrote to memory of 3380	1416	msedge.exe	88
PID 1416 wrote to memory of 3380	1416	msedge.exe	88
PID 1416 wrote to memory of 4048	1416	msedge.exe	87
PID 1416 wrote to memory of 4048	1416	msedge.exe	87
PID 1416 wrote to memory of 4048	1416	msedge.exe	87
PID 1416 wrote to memory of 2100	1416	msedge.exe	89
PID 1416 wrote to memory of 2100	1416	msedge.exe	89
PID 1416 wrote to memory of 2100	1416	msedge.exe	89
PID 1416 wrote to memory of 4768	1416	msedge.exe	90
PID 1416 wrote to memory of 4768	1416	msedge.exe	90
PID 1416 wrote to memory of 4768	1416	msedge.exe	90
PID 1416 wrote to memory of 5052	1416	msedge.exe	91
PID 1416 wrote to memory of 5052	1416	msedge.exe	91
PID 1416 wrote to memory of 5052	1416	msedge.exe	91
PID 1416 wrote to memory of 1544	1416	msedge.exe	92
PID 1416 wrote to memory of 1544	1416	msedge.exe	92
PID 1416 wrote to memory of 1544	1416	msedge.exe	92
PID 1416 wrote to memory of 2128	1416	msedge.exe	96
PID 1416 wrote to memory of 2548	1416	msedge.exe	97
PID 1416 wrote to memory of 2128	1416	msedge.exe	96
PID 1416 wrote to memory of 2548	1416	msedge.exe	97
PID 1416 wrote to memory of 3696	1416	msedge.exe	99
PID 1416 wrote to memory of 3272	1416	msedge.exe	103
PID 1416 wrote to memory of 4152	1416	msedge.exe	104
PID 1416 wrote to memory of 396	1416	msedge.exe	105
PID 1416 wrote to memory of 4236	1416	msedge.exe	112
PID 1416 wrote to memory of 4236	1416	msedge.exe	112
PID 1416 wrote to memory of 2876	1416	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Anime-Expeditions-Creams-Macro.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9e9a1c188,0x7ff9e9a1c194,0x7ff9e9a1c1a0
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,10095448192921640899,840178520542370449,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15465378086326490746,15117837686839189226,262144 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,994278402536696521,9881781525978837055,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,12557483658536425863,901458984531985876,2097152 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,9897741868427771790,5733690235791305815,2097152 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,9028808823712638367,14196425065425273813,2097152 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,5080798282380247724,18331642633325738133,2097152 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16309467015457483872,2082747436620779312,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,8476683807301828608,4566184096566631036,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,1042048056140050624,7487059234475972209,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,1042048056140050624,7487059234475972209,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,12415804187982578642,8919884949239285865,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,13648972192315777773,11014810262963988475,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,10877704093102910651,14370364259019447543,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,2600968163378407116,6069429853371106402,524288 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5796,i,16298711661707098448,13154823786457024920,262144 --field-trial-handle=2648,i,5997431103021847531,6414929186708644478,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4b8602dde1da1346e4264ac5c746c3b8f4e6ed90d8f6dc70c966e47a46fbcff4
MD5 8f5b7e96b0cc269faaf148bd6ab974f3
SHA1 bcdd081547cd79aed25e9a796148c944f92cb716
SHA512 c9b76ee0c8e715ee951f8136116413f0007f1a35971e9ac923305de05f7ca8394318c08793cdf8acd1409bad3b900c499d940b4982aab9e9679300e37fbe92fd
TLSH
T1AA710A3938B204E1E3B3493196D10B2676B28EEAF52B1FD10A2014F5B6117E24D5F779
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584d6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584d6f.TMP
Size 3KB
SHA256 9efb019ddf9546eaf7155cfbea344b90276e102972563fea209cbf194f6518ae
MD5 361708bbbf1acbbb09f52e1eaffb826c
SHA1 b7b5c4560b787538f1afccfd45cb5220905c5736
SHA512 2adc503bcca4f71e86a1e4a925d764db3bb4732715e4f2d8ee3fd505d2d057eff63668c7919c4609392d8fb542bc34c010a41d8b168ebd9037dbcc992b10eb42
TLSH
T1CD710A3539F204E0E3B3493196E10B2676B28EEAF52B1FD10A2014F5B6113E24D5F779
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ec16323129b02516425d42e092ed4174921451328b6cac184d9b6b43a82e71cc
MD5 5badce16572a88fdf659572a2575371b
SHA1 2631dc97b6724a464ca373f727091066c2372244
SHA512 894229eac2dc0bb9d79ffbef6ce2c04b74bd53e9df535ee07d6e0e81647471847a588d4a23e30ceb7f13bd8311facaf03c77001325b91dcef9b1bc410ab6038b
TLSH
T1E231A0F683E4467E8A1156F09A14AE2BCE2C0507832C7C6989F4BF1BA3F3471D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c819727049d008365dda3575ea4c9d6738bceaf1f00d3527bc1ee8a68fe0c2be
MD5 0bc434b37a9b7e67f097ff24947f873d
SHA1 83b82f57a961fa64599d781414cb618b5595f532
SHA512 f87192700c4d26a6f159c708309705c1d8d0fa144721b5f970d830840d73d83cefffa6e75399b2663bbefae18c8a5665f0a7b79ced8c09025ad52244e03da49e
SSDEEP 192:sxZeRfyM/jK1Ml8Mkf/fnsf2eIdpdxHW6+WNGYIk+5JzIgrJ:sxZeRMf/fnsf2PfHbG5L9
TLSH
T18342E8116B34AA7BCCDBD20DFA557F53D6F9047292900E54A9FCDA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dd0af063cbce78fbab577a7be4ac1e9017c8275842b4206d62e32dcc733cc048
MD5 cee83049dfb5144bc5b50a419fd750a4
SHA1 6d81c8234ca541158d103915decec6ac4eed5153
SHA512 881c1f6e3ee30f4f7097544ec039fbbcbdc15cce4af6001aa784e84f5a4ef4f5ac0a4584d8c6b5af386c55fe32ba5e82fa84098cf2137464c4978573b8a1a943
SSDEEP 192:sxZeRfyM/jK1Ml8UQvkf/fnsGieIdpHxHW6+WNGYIJ5pN5JzIg5uJ:sxZeRqcf/fnsGiPRHbGf5LLA
TLSH
T17952D711AB34AA77CCDBE20DFA557F53D6F9447292900E44A9FCDA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d7d289883c9f00e23772cba1dc0548c615e6e0d9a70492b8e2b3aab16f107727
MD5 b75f909210bfeff164f1cb67e751688c
SHA1 7491a808f60110cec2830637ced74b13995a5280
SHA512 370ac01ade9127b63152969430d6e4476482e55ae21fe84d8401bafd1a68a378d728c8c729240eee98de51ad9e8746cc20fa8aa37d2876ff11f9043ca040adc0
SSDEEP 768:uAsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9JrooCT:uAsqxXlWvJD6Tu1ja54LAs9ioQ
TLSH
T177D21B3B694CCB7E4F840E5CEC266FD76ED801CB66988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 81bfc50d5279be56ae9e039b1fb1cca1f2ffb6576b5074d6dfdc53a177d4fd27
MD5 95b92d9d461d80070dcb8094014cc81d
SHA1 c1e80a97920f0a1772ef4774c3dda6b349c332a5
SHA512 af783c96be4dbd45f3d4973b7b0cf39c347f859355553be8067889e15f87b746990ce9edd5f8d26d9116842fb516bb99b661584f3b7d64bfb05cccb449b5cd04
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyNvItKE0o/yFjIhKQgEciI/KHqsi:KYbaKYIKmveKE0i2jaKQgriAKHql
TLSH
T10FB10111317F02417CBF291CA1A6A5278E4131B33418A8AF7F7941B249AAE225DFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adea2329-87af-409c-a36d-b1c17dd3954e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\adea2329-87af-409c-a36d-b1c17dd3954e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1e3c88b302b8cb0ffccb9cc79b3532184055c59eeaf89837aa685d2e864292bb
MD5 3312b0182edbe2a5cbe0c9c13dda7f63
SHA1 8fea9b64c7408deefbe75153c912e872bd4518d5
SHA512 9441601eaac581c953f277d98ea01ab9440083ac2d03bef1ad763c8a8eeb8765a144f802ae949f898ffc8bd6a754892534cc6ce055dbae6bc692343cc5caa3aa
SSDEEP 192:udLsNdXQ2yNPf6kRbBgGQmiU1LyQ94VRNQOmyOmHA9z+IeSRtq6zU8:GsNdXexf1bCitDSVRNQOxM9qItjU8
TLSH
T196321B32AC385D3B5EE2A545F48737039FF85027AA892F94D1DC6B1C05DB6DC134B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5523ce29460ec04ba6a05f0d973cc18ff5f56bbe1b7a6726ce637b7e5f9c65b8
MD5 7c2dc4a92924b7125e140bfab02d932f
SHA1 9f5e6899c7225a08c1065a902c37cfd09d59a621
SHA512 2a0073470c123578fb39934cba6fd553c7216725a86ad620f7d97de421e5adf826a7ea084656ba23ae85651c4bbfe442a3eb9268e2bf4b4968fb7b7d7f556be1
SSDEEP 384:y3iFiZcIKzsNn8TUNTUlIlTexf1bCitDSVRNQOxM9qvRjnTKwBODNZOCk0Y:FFQCOwgE5A0DgHQOW9qvRjnewBKZON0Y
TLSH
T1D5A26E735D288D7BAEE6AA45F94B32038EF85073E5C56AA4E2CD6F1C01D65DC130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18c4f872ba522a40e5a0a79207d52c2523b5275d309d1f8cd711d29b14cc6442
MD5 2d7acada162bd91a64750a0e69c7086a
SHA1 b29d6b252cd23993c96ee8d46276ac72d19fddf2
SHA512 52ec70d1c8452b2bd75764716b3487825427b6f1c90daf86389bd9e6fad8fa68f956c81c6c7481f6711fbbc04e320b296904da02bc3fe9481f0d552a7c7f83b8
SSDEEP 192:tON86JkRtQmiUyI0W+RNQOmyOmWh3QRYU6:tON86UrkW+RNQOxKDU6
TLSH
T10F02E935AC386C779EF2AE49F98B27175FA8203BE9552F80DAD81B1C01D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3531b53ceb54d4ef68d030e5692589801f926796822063627141612e96a621cc
MD5 ef058b635aaf11f270f5e92aec9b6c01
SHA1 68363e3fc4f9e826a410b12f011296aced3db321
SHA512 b03c9db50dfbaab2011fc3852ec91994cc49021cf2413a941f60146d4f5f47739fa03d29bf786635ba72ee0c4d71f23356c6db23875dfd499929533fba1a32d3
SSDEEP 384:oZcIhsNdTexf1bCitDSVRNQOxM9qItjnTKwBODNZOCk0Y:Whr5A0DgHQOW9qItjnewBKZON0Y
TLSH
T1ED926C71AD385D7B5EE6B145F98B32074EF89063B6C82F9491DDBB1C01D6698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 963309971c8f41d100b4b025ffdad427aa49990a9db02879e7b757c1c0073012
MD5 79583001acb31e4d2cd2fa26f3651422
SHA1 16b41691b80907b1c9162442dcd1f886e18362fb
SHA512 c3581faf26b1aef9af3eea6b6ae8950ac52eb416bb6c6c070997ba58f993475d96eaa0101b51156f45029185dcfe13b8191c07dc09365d40528fbf630a1d8895
SSDEEP 192:AONA6JkRpQmiUyH+0O+RNQOmyOmHA9z+iVctq6zU6:AONA6UHaxO+RNQOxM9qFjU6
TLSH
T1F8120936AC386C7B5EE2A445F48736135FF8512BEA897F80D1DC2B1C05DFA9C134A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7e9ec3c58e5d27cb2d32494a93f69c9260c1e212479c98e227d3a9dca6793b08
MD5 6614ecd6065c489402f5d79adf715fff
SHA1 447980c710740ab60646913ae712d2ca816058a0
SHA512 5452fdbcae4e51486fd8d14713772e986a18f62614c73aa08e588f9841f3fc3bfe16979038b3eb0c3c920d5b84dae622e5d0c7e34b97db66005a5fbc43e91927
TLSH
T16341E958B7E91148B3B77F5AABF664AD487AB8772E06C45D00110D4E0A73B40D861737
MD5 SHA1 SHA512 TLSH

Submit Download