32924119594b70c9a6f5962ef0a4c41ffe7373bb87446ff1276354a4a0139f1f

Analysis

user interaction
yes
max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Anime-Expeditions-Creams-Macro.html
Size 365KB
Sample260814-d2gefstfja
SHA256 32924119594b70c9a6f5962ef0a4c41ffe7373bb87446ff1276354a4a0139f1f
MD5 1217573c568938b02ec66f0e171a42b2
SHA1 4bcb4ecfc4f01e134a47c16470b1480343c0d5c9
SHA512 652321f746ff2d9898b7cd274a3dc07827b46a4a57649d8fc6337d5c40910427ebc3d4c23839195ad446709a3b36eb2d1887f498ad5b9b867404fb321beeed03
SSDEEP 6144:ixrUACC8M7kNUREMP82ZitwKl3p3ZWJ4X4j1crHGusny5D0MwNslv9VttmwS2bMT:ipUACC8M7+UREMP82ZitwKl3p3ZWJ4Xe
TLSH
T1EC8408B1B074923E064F065AF4706758D39AF28AE65A68E2C93FC3F482D3C94F7A3155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	camo.githubusercontent.com
35	camo.githubusercontent.com
41	camo.githubusercontent.com
43	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4564	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311518246290259"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{4A40E1C8-E533-40ED-BDAC-2BE999F9C4D5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 2756	3540	msedge.exe	85
PID 3540 wrote to memory of 4564	3540	msedge.exe	86
PID 3540 wrote to memory of 464	3540	msedge.exe	87
PID 3540 wrote to memory of 464	3540	msedge.exe	87
PID 3540 wrote to memory of 464	3540	msedge.exe	87
PID 3540 wrote to memory of 4652	3540	msedge.exe	88
PID 3540 wrote to memory of 4652	3540	msedge.exe	88
PID 3540 wrote to memory of 3980	3540	msedge.exe	89
PID 3540 wrote to memory of 1064	3540	msedge.exe	90
PID 3540 wrote to memory of 3980	3540	msedge.exe	89
PID 3540 wrote to memory of 3980	3540	msedge.exe	89
PID 3540 wrote to memory of 1064	3540	msedge.exe	90
PID 3540 wrote to memory of 1064	3540	msedge.exe	90
PID 3540 wrote to memory of 5108	3540	msedge.exe	91
PID 3540 wrote to memory of 5108	3540	msedge.exe	91
PID 3540 wrote to memory of 5108	3540	msedge.exe	91
PID 3540 wrote to memory of 896	3540	msedge.exe	92
PID 3540 wrote to memory of 896	3540	msedge.exe	92
PID 3540 wrote to memory of 896	3540	msedge.exe	92
PID 3540 wrote to memory of 2440	3540	msedge.exe	97
PID 3540 wrote to memory of 2440	3540	msedge.exe	97
PID 3540 wrote to memory of 2404	3540	msedge.exe	98
PID 3540 wrote to memory of 2404	3540	msedge.exe	98
PID 3540 wrote to memory of 2028	3540	msedge.exe	101
PID 3540 wrote to memory of 456	3540	msedge.exe	110
PID 3540 wrote to memory of 3364	3540	msedge.exe	111
PID 3540 wrote to memory of 4804	3540	msedge.exe	112
PID 3540 wrote to memory of 1800	3540	msedge.exe	115
PID 3540 wrote to memory of 1800	3540	msedge.exe	115
PID 3540 wrote to memory of 3688	3540	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Anime-Expeditions-Creams-Macro.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fffd007c188,0x7fffd007c194,0x7fffd007c1a0
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,6857846547452497192,10604232163239062011,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,7835366941299912392,609966649169043817,262144 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,5350763697410596159,5057608202530641838,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,8699730148227473148,4915057265799514818,2097152 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,1640467488060553087,1347728708046560018,2097152 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,14543635803250797629,3784019027155874720,2097152 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,1048387462966643119,15743979373490908809,2097152 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,4442671267820239335,11928060251746767373,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,11575198091095032751,5147667144531778963,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,7758345135794051285,2672605515357452732,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,7758345135794051285,2672605515357452732,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,5883975295404708877,12742557873398510455,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4213704394124836986,2788564469119689296,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,8975686044629952692,333881054285212491,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3725699061334616732,6159293894621774897,524288 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,17771098981613141517,16591112355557538786,262144 --field-trial-handle=2256,i,4315232461280203865,3758208885227956482,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c7cad7efa7e7a649295f28f79f4170965b4a98888397947123a91413ae80ad6f
MD5 7801782c11c87d8f26deb563f4d06614
SHA1 7198bfd7ffae9bf62d4ffcc6773d995420e9843f
SHA512 a1025bb2bb142aa59ad2fcf2e0609a814466d135303926658315b629038fca220fe1c763797d742a2efe5085baf4ca1c3ad4193460df90a8e2d507037e3c2b2d
TLSH
T17371F92D044E49A3E36C2732E0E309CAB274CD984FD74EA35034993D678EB56CBE546C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588344.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588344.TMP
Size 3KB
SHA256 25b06e99c2a3fe591a304140b6d269efb3a9684d926e0af77fa71ad52809c0a0
MD5 47cab4e7bf6848f28277dba9c0c053e1
SHA1 fb0e4d93c3e101bdb127928890561557df52cbcc
SHA512 10298d4336aab8a264c423fde35e35280b323be3299a79a4b24136cda8473c920b0461ce86ff1ff04dd8805cfed21d4adef3bc722fae004f53aef78e3e288fce
TLSH
T1EA71E82D080E49A3E31C2732E0E3098AB274CD994FD74EA35038993D568EB5ACBE546C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 307f10a22a1f9bca02ff45d28944c14938f582c0b8391fe856ba88ee9cf42fbc
MD5 caf6e735105ed576f0e8492536d92378
SHA1 6cb26a8cb608ce1f91daacd748b0aad73c9ce5bb
SHA512 79f44bd7bbaea7050b3925d63d500a014395d6e4c9f6008880cbce121b4cdd09a604853520ed760425365ca891653548b1476065cbd0aea7360c10031fd23b8b
TLSH
T1A43191F683E4467E8A0156F09A24AE1BDE2C0517832C7C69C9F4BF1BA3F24B1D10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d4504b52ec3a5fc4065745c706012f5381eb4a5c38a04d38d895e2e1cfd63ba7
MD5 3873d62c8be05e27571aa2a945e65b05
SHA1 b167525a80fcdd1560ba9fbfc979dab5b541af5f
SHA512 80086b3c5bf8f4874cf111a497173b10d8a51c15b64ebe5200aa14511df99ff1bd25dbcd62882eef47c310c95a9a99d83a77cf7283dbd032fce69721318846c0
SSDEEP 192:sxZyRhyM/jK1Ml8MkK/fislDqIdpdhHW6+WNGYHjlmpIgrJ:sxZy7MK/fislDjvHbGR9
TLSH
T10C42D7126A34A977CCDBD209BA557F53D6F54473A2900E44AEFCDA1C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1245e517d9a244f7053c0790c071ccf2d06a15f29fa6dba4b2a20b8568f36c64
MD5 651657e97f5581bf783c17b316731cb2
SHA1 37a1d3fc72c658ebde9bde3ae723720ac85990b1
SHA512 8810226c33b0ec731b6e5383f4a1dfc17fc0c70499cad621cf3bbcfb55d373ca8586824bcb4573e55a2dc1108232a4adedf6d2131906da31adff0c216a999ea2
SSDEEP 192:sxZyRhyM/jK1Ml8UQZkK/fisJnqIdpHhHW6+WNGYHkYWpIg53dJ:sxZy7qaK/fisJnjBHbG5l
TLSH
T10952D716AA346977CCDBE209BA417F53D6F5447392900E44AEFCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 14d915cdcde9ffeb8a1ec1b049942c4572a116b7f8802eea12ee963086fee598
MD5 834601b36a9bb596c33457033b61c123
SHA1 304db756adf8b209bda9f96553b30117e3d6911b
SHA512 2b378461ef4c94f42ad392d397ebfbc3a1e90ad5edbc705420c58dc87208b3f65cffa060d2225dc0d9a62d6367d6330e34eb2164f136da866aaa347384efb390
SSDEEP 768:BMUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RuroVC0K4:BMUZYTMWvg0Pou1ja7eLZmRl/K4
TLSH
T152D20A3F280CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA894C02CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b13a7f158a6bee2b3fae4e6afff97b79a23f9c0c0d864592f340f6a378f0fee3
MD5 60944efb2eda4ec1551ff4e97bcd2629
SHA1 28ce329a5d8c696b0c0be772e13a46401af9396e
SHA512 f98d28e1a72ead4f5eed6e0c8e7134111751606d3372fd96d762d92834c7aa29257953b3c04ec1da8fb39545f100d3f6e489444a8d87ff55cb7faf22a9eba282
SSDEEP 96:KA1eK2AMaMKXqOCOkKHqUdOKmkS2LWKEg3o:EurfyVlb
TLSH
T18BE1E00276BB02033D3E2918A39987764F85F6A33418A42B7FA840B55E67E345DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591da0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591da0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 43e902e0a99cb3c04e53c1006a27e267dd8071108b1d98af4afb71e65a7dabdf
MD5 a30c8b9fc0f1fcfbcc5fbcc314fd5bfe
SHA1 74a507dd8e51b1ae991a164597135c0d27ec93b9
SHA512 bff36fbee4e91c987cd634da7b45d654be7bcc4a9b47d1c24f614a7280982c5e85b0df4e180ab3f0fa078118a5cf519fbdbb94fbc62888eed3d856c08b2ece52
SSDEEP 384:UZcIhsN77Mpx7IyzX5od+d8y0VuXR0cOOPrXLpe8C/NtZ:ShRsGO7+R0cOi9PwtZ
TLSH
T150927E32A8786C576DF7F645F84636039EF88167E7C42B84D6ECAB1C01DA5A8031BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 640b9233349ac76b2605a841d38315a9c88e18019f942fce13b026bb6d374524
MD5 af05f6adebe23fe38306b592148d09d0
SHA1 ba7439c20360d78c4f4f1efea687920877c2a734
SHA512 bf97ea3e8e35891d224c50380242ec426380d9e0d30871a2aa5b117ff97aa80658a842162d88b655a0b42e8ef8bae292c09d197f5edaffad752037daf51b2ab5
SSDEEP 384:6iFiZcIYsNF8TUNTUlIluMpx7IyzX5od+d8y0VuXRecOOPrXLpe8C/NtZ:xFQYAwgRsGO7+RecOi9PwtZ
TLSH
T112A27E3398689D6BAEF7BB85F94A3203DEF440A3D6C56794E7EC9A1C01961DC030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 01eda51bacec42bca09059944d7e0d5f8217c30a236ec4579dbc5fadff1ecf6f
MD5 141897dc1cf730f860d78781a6f8a7dc
SHA1 bdad3dac9ef71c85caa8457400b7fa1228fa987f
SHA512 45adb61433f9b14c56b607697250801e3f73f3815277d185659a1e16f01ca5340a3cc06312e84ad8e0c9ab697932e3ec6c7bcb60b2cf98c67a06c31f2e7f1f04
SSDEEP 192:yONR61VWQmiUyxsgGX5Obd+j1jzory0aoX/a/31IU6:yONR6WzgGX5od+d8y0VCNIU6
TLSH
T1D202C735A9286CAB8EF2BE4AB48737135F951067EA952F84D6F81B1C009769C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5c9ba80488bc8efa0959db0873e96ccd2de58413af22595a9be20b1794d681c9
MD5 d94fd5a7c7157824e5c289f24780329d
SHA1 a0c8abd262b96adadf83bd1f4fa1ac4494679537
SHA512 b8bfd481f50a0541b5b4e2ce163852f28783fc600536f221e66eae4c905caadcdf12af7a7afcb6ab4452c3f3a9e11ee6262c379ddb06e4a3332caf4ab62c54e9
SSDEEP 384:AZcIhsN7uMpx7IyzX5od+d8y0VuXR0cOOPrXLpe8C/NtZ:+hMsGO7+R0cOi9PwtZ
TLSH
T1B2927E32A8786C576DF7F545F84636039EF88167E7C42B8496ECAB1C01DA5A8031BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 00bd3d6a4ff02a5d8f2112b10fb08d7132c2c125abc23839d0bbf995768510d9
MD5 d4eb1a9bc3368976aa1171b1cefa81f4
SHA1 9ca85d0aa7844fcad91a385c8315d6b10e8b6cd9
SHA512 1a9725ec5aafe448d5245f939461d12acffa7881ed2b4808bd37e90cde8d85561af0d43db7bfe051f70c77d3ca0230894441b67201264a84eb7ca081e5823caa
SSDEEP 192:9ON261YWQmiUyZsuGX5Obd+j1jzory0aouX6EUjJZqFnU6:9ON26R1uGX5od+d8y0VuXRMcU6
TLSH
T16A121A36A468AC675EE3B585B48B32139FA54167DB857F80D6FC2B1C01EF5AC130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fdc8b70-82bd-4357-911b-f4f4a1771a20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5fdc8b70-82bd-4357-911b-f4f4a1771a20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43cb2a5d25e27832b8ac85b920485e8d55e81f09062bdd428aeba0627a01538a
MD5 1c4673154bc17008b8d09ee4d0ebdd1c
SHA1 ab99edf2de3dfd9485743629ff92ad4202f252f0
SHA512 02f640700700649f560ab159a6cecdc131397f63d37994da211565eb9f4aab89acac3f568cf9751db82f01bd5eb90bc2c1000c35ee033595ff6535d52e6f8ec5
TLSH
T1C3412949A6F90148B3B36F566BF6A86E887FBD372F0AD05D00110E4F4A26B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download