hxxps://bcscomputer[.]net/mackkj/

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bcscomputer.net/mackkj/
Sample260805-kzf48stdkg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303948769342520"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{F8A27A87-2DC6-42EC-979F-811410C17BFB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1076	4984	msedge.exe	84
PID 4984 wrote to memory of 1164	4984	msedge.exe	86
PID 4984 wrote to memory of 4656	4984	msedge.exe	87
PID 4984 wrote to memory of 4656	4984	msedge.exe	87
PID 4984 wrote to memory of 4656	4984	msedge.exe	87
PID 4984 wrote to memory of 3356	4984	msedge.exe	88
PID 4984 wrote to memory of 3356	4984	msedge.exe	88
PID 4984 wrote to memory of 4108	4984	msedge.exe	89
PID 4984 wrote to memory of 1116	4984	msedge.exe	90
PID 4984 wrote to memory of 4108	4984	msedge.exe	89
PID 4984 wrote to memory of 4108	4984	msedge.exe	89
PID 4984 wrote to memory of 1116	4984	msedge.exe	90
PID 4984 wrote to memory of 1116	4984	msedge.exe	90
PID 4984 wrote to memory of 3700	4984	msedge.exe	91
PID 4984 wrote to memory of 3904	4984	msedge.exe	92
PID 4984 wrote to memory of 3700	4984	msedge.exe	91
PID 4984 wrote to memory of 3700	4984	msedge.exe	91
PID 4984 wrote to memory of 3904	4984	msedge.exe	92
PID 4984 wrote to memory of 3904	4984	msedge.exe	92
PID 4984 wrote to memory of 1260	4984	msedge.exe	96
PID 4984 wrote to memory of 696	4984	msedge.exe	97
PID 4984 wrote to memory of 1260	4984	msedge.exe	96
PID 4984 wrote to memory of 696	4984	msedge.exe	97
PID 4984 wrote to memory of 3236	4984	msedge.exe	99
PID 4984 wrote to memory of 228	4984	msedge.exe	102
PID 4984 wrote to memory of 228	4984	msedge.exe	102
PID 4984 wrote to memory of 228	4984	msedge.exe	102
PID 4984 wrote to memory of 3652	4984	msedge.exe	105
PID 4984 wrote to memory of 648	4984	msedge.exe	106
PID 4984 wrote to memory of 4924	4984	msedge.exe	107
PID 4984 wrote to memory of 4376	4984	msedge.exe	111
PID 4984 wrote to memory of 4376	4984	msedge.exe	111
PID 4984 wrote to memory of 3476	4984	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bcscomputer.net/mackkj/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ff8ab63c188,0x7ff8ab63c194,0x7ff8ab63c1a0
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,11925147465743850896,2965718547532109816,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,8336256638973987015,9557780558972846582,262144 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,1114472933962389122,12022928108276593076,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,17300283087071431177,8826940958318652199,2097152 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,10978132129601070943,14791233607628487351,2097152 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,9008148715154112108,15397481292297294432,2097152 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,15959786287636162326,2094155968961963093,2097152 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,17039169334177322062,4915616064946341441,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,16950495170027360182,14151324787320208480,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,7593378992286130368,9935101801283763132,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,7593378992286130368,9935101801283763132,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6380,i,12555736472476726098,6382559282840490495,2097152 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,10972046208266549594,1235067498057268691,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,18309006084705925609,937195372119357972,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,11005535170137957966,1534977889643180980,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,18086462626223677019,6956786327499227076,524288 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3012,i,6008322403178225257,12854349868130116866,262144 --field-trial-handle=2436,i,1122757653655049687,18307594040116875982,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31d4eff0c3191cd330eb7d0c25c256b1febcd2ac70fafe841de58c4adb7d1b28
MD5 2f73f154b59724f5ec16c3c33b5f33b5
SHA1 b338ee5e4072009b7df409dbfacbc5f17c2ad464
SHA512 8a56f30ab0b0792f096bdfd6219adcc00d4d725544f59b7138f6209e99a3cfdd548c9bfb26590b151859bc585f2c2bafb0ba5a1342b54ef2be2e0d263bb02d54
TLSH
T106712D1C222A7593F3131134ECD1E6DBB8B2809E49776F1D0488DBFEAA1AB15816F40E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59425e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59425e.TMP
Size 3KB
SHA256 6186bc42c0255d705abbd9b2b7fa2110bcd22682a59712e185629aa0ee293aea
MD5 47b9ed95d5acf9f97b77bb166c47d38d
SHA1 ff2cde84ca0017c9dcdd18c3f020d56e9a2ec0c4
SHA512 748006628249c2c5a646e3a764f6c723477731c3d5fbca9d98d3c82d46336ed79e469b7cc4f34f6dea4c1aa2f4e63cc05c85f8b3ae5a012148671cc33f2dada0
TLSH
T11871301C222A7593F3131134DDD1E6DFB8B2809E44776F1D0088D7FEAA1AB25816F40E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c4b0f91055a3267eaab847daf2d8a572deaec408fe0e68606a81383a24a37573
MD5 e54bd78aeef914308380e6793cad4e90
SHA1 ffecc405c524f772bc047af22824c5d0628664ea
SHA512 b2faecea5a53d8fb0a5dc400e4284fee1056623fcff4e16bcab8afc399fbd389b3935a38928ce0f471d5a90f6e22ea68cf0f13dca484c4618859049d154ddcd9
TLSH
T1E041CEB3C6E4C66ED91112F56A247E2BCE1C051982283C6ACDD5EF9BE3E3471E10198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 428649b2f7341f579053b82084a3987c40aecdd29eaf0f0c955596075fac7659
MD5 47b48a183da480415cd2c6840ee00170
SHA1 9d4a6034098c2f12436e3733da3adf50834eca35
SHA512 0ef8cea8cfe83b2759794ca2d51420cf68ba9fb45f5a4865b27e5dc7f6f7eb9ccaad1d0188734705ae050dc46286ea939546a3fee34b8ac9eab9fc7b452f44ec
SSDEEP 192:sxZ/R/yM/jK1Ml8MkT/f6sTuZXQIdp3VHW6+WN8gZ/Y4M0H+oIgrJ:sxZ//MT/f6sa9xFHbV/7n9
TLSH
T13E52E711AA346977CCDBD20DFA55BF53D6F91472A2900E44ADFCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 831d4eee878fa7c8ed909bbf8e2dd1875e2aab975d570326d822d4c0a297d0a9
MD5 c2659871c701b89888fd3f3fe8ee6809
SHA1 d6e2ab88951156d3a8bb8b7472dc58f228ca5a01
SHA512 218ce32379400a7677b785dd7bb8616c404cc9fc4f89603f81ffe3f5ae172c2f2def409e353dc49a250521577d28bf406489818cdca89bd00f9bf79da44b766c
SSDEEP 192:sxZ/R/yM/jK1Ml8UQkkT/f6sXuZoBIdpdZfHW6+WNb3gZ/Y4xRM+oIg5iJ:sxZ/Zq/T/f6seyqTHbA/Wn4
TLSH
T19462E612AA346977CCDBD20DBA51BB53D6F9147296900E44AEFCDE1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b9763bf258405f69ab51d51d88cf7c1aba4667f39f4211e3e992f7d347ea98d4
MD5 7f2e7e55bd7fbf20dcfe99129ef2e99d
SHA1 1eac9774c307f4e996e4a3b5c881653e2e6d87b1
SHA512 5518440c1c7c795421bbf4f3a09d9729e3ab4b8f3ac14ee190a454f0e889ebee7978ba2af83c23ca076effe7df79a3852effd1dfdb4dbb65a2550ee7c01d3764
SSDEEP 192:sxZ/R/yM/jK1Ml8MkT/f6sXuZoBIdp3ZfHW6+WNb3gZ/Y4liH+oIg5iJ:sxZ/ZMT/f6seyq9HbA/En4
TLSH
T16D52E612AA346977CCDBD20DBA51BF53D6F9146292900E44AEFCDE1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 194c15643eeaf276e45890cd3972fc2f790d9d692fbf52529d1e036f6f9f6b32
MD5 cd27d2c498723fcbf75beeb5fe19a88f
SHA1 ac8045d1bc4f960017bae5d47611dbb143dd4e4a
SHA512 c3d830d93374f7f83373bb51639e48154b36ff08bc53535958138aa16a4567d72ed8177c72c8200e976f9c8f89e4929242e09a02b6ac0f902eb9fea2a0890f0d
SSDEEP 768:tZ8iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdarodksUnu:tZ8iJPNWvx78ru1jahALocdRJUu
TLSH
T14AE2FA3B680CCB7E4F844E9CEC26AF966DD801CB5B948D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 45eb15f1ab59e6639198333d347b11784c64a44c4033731cf5098a3b462de524
MD5 b514768cecb1bcf7ac73553cd83d7465
SHA1 b59222959e28a8e6da5831ee6511574b2c475e3a
SHA512 a9fc904c09dd77da957df144e63c142805bf16cea408ac8caa582b60bce48482a46f045b0d89e3984e8903b3b4c085f1ec382c51ff88189d3bbb6cfbaf084362
SSDEEP 48:KSVFVAVRVlVDVbVrV2dVbVeV9IUVlV2KzVTrV/V2vVNVmOVmVPVFVnyJcIPKFGcN:KMEQKV6uKcAKFGaRCK6UaK
TLSH
T126917F1172BF52013D3E390C9AA09627564231633418E5AF7FA902B29FA7E251EFCDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d683d961-881c-4ca5-9e9c-83b481685c26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d683d961-881c-4ca5-9e9c-83b481685c26.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ce7ee9caf832c90a0956f06b89436d8aa6d9b91dbfe588d6c00c9a866bcc0b3d
MD5 b9cf992d105867379d1dedde649c9f0f
SHA1 b3c96987ac266399cf6642e932ec4db62d5d6f36
SHA512 8eb97062e0524c4f13a05dc61891b5a649330e3eb46cf3ded084a5fdde05861e037354b5916c961efb36c04c716000f9a3d868d2ff6ed904cc95ebc6469b4889
SSDEEP 384:uZcIhsNRU3/w1mkD8h/Xt0jSBeRs9JKgqijU46:Mhs2wSTjKgqmU46
TLSH
T1E5929D315878397B99E3A985F58636274FF59027E7C46FE0EDEC6B0C018A5A8130F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 31a653ed287c37e6516f5b051fa2d87ab2f1473ae10ab402f58908a8b7bbc65e
MD5 7c496f15b005ba2ed3f132891024cb1c
SHA1 4b97e31ac13261105de5fd4094ac9499a5a5a4fa
SHA512 31bb6e58642c552694200fa07a1a6ef4fce6b6607542240525f5972bf356d2d4cb682d282a5ab427e575df80cd9962b3586e841c8aa7224f1c2656d13fb33939
SSDEEP 384:nqZcIEzsNRUZ/wBmkD8h/Xt0mSBeRs9JKgqijU46:I4G2HSTjKgqmU46
TLSH
T1AEC239F154E72836D5AEA747B3BD2E134EBCD017B6841A90BBD85A0CCC8657FC30A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 718227669d626a4bda5a7114343ce5e3f0f6ac4c6eb7f9c8d8a0cc2f5f78f65d
MD5 0ca54c2b7063434d34f5e15ed1634138
SHA1 992e0b79509f8ee97d9bf44e7646b70f34fee307
SHA512 cf8d2c8b8ed9c9cc29f1f6241c3bf2aaa25341fa67eb2b3256e91ea70d412e63a99bb6b59e87d9c7289ce164490839011bc24f2b7d5a428174a905ea794fcefc
SSDEEP 384:kZcIhsNRUZ/w1mkD8h/Xt0jSBeRs9JKgqijU46:Ch22wSTjKgqmU46
TLSH
T1A8929D315878397B99E3A985B58636275FF59027E7C46FA0EDEC6F0C008A5A8130F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9bb124eee25c4865e8c4e8ad192fe2f247d02de9a1d13299e7e4871c7073a61c
MD5 8dba51689a51ca055dcd434092808b8d
SHA1 4491e0075bcd160b5bf56970ff29fa6587db51aa
SHA512 f659b13be2bd7912b7eda16ce192104509a559c9309957dc15da417babbe6ffa678ccd17d17a86e3727e662a000092f2f22d5994eac065e86e05903103d4e521
SSDEEP 192:gONl6kDfQmiUyO+Z903ajzorhfQiplVVU6:gONl6ghuZ9D8hnrXU6
TLSH
T15302E83568782CAB9EB3AE49B58737175FE5112BEAD52FC4DAE81B1C00D764C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a87c47c7ca4f46324909394ac825258b1bea27cd2f9937472512c24844f5d7d8
MD5 347aaf56fb67d7558225067dfdb70fb4
SHA1 911432a43453a672316599658f971ae388545bac
SHA512 f5c7395b9f9034604a3fe38a793934ed236fcceb4450d2ccc163199aa1755c35d6a3cc2cda84022e3ca22f929724b5f0d41a4c45e81eacdf01a82d7f300346da
SSDEEP 192:uONr6kOQmiUy8+y903ajzorh/XHN09cRkqoU6:uONr6TCy9D8h/Xt0SSU6
TLSH
T16A122B3264B87C6B5EE3A985B08732235EA65117EBC86FD1DDEC1B1C05DF66C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d93b849d-5959-4033-b368-bb8a695cb5c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d93b849d-5959-4033-b368-bb8a695cb5c5.tmp
Size 27KB
SHA256 a33ab02e971d84552e0ff0fb48ce6a6c07daf1c284a2835dcfc93040152fe34d
MD5 2cbdf1e7e4eefe530a3a7251cca5111e
SHA1 69580bf7838482c00bd48171a6c1aff95e890f27
SHA512 3b467672bad38edfdc8261fa7822dcc5c95d185ee86d3611d3e1e7e4f52a55a895691abbe0e7ae648a11955ac0578cf9754b4106574dac9034a0e980c7bedce7
SSDEEP 384:fiFiZcIEzsNp8TUNTUlIlZ/wBmkD8h/Xt0eSBeRs9JKgqijU46:qFQ46wga2VSTjKgqmU46
TLSH
T13AD229F244E7553AD9AE9B47A77D2E134EBDD027F5806A90BBD8590CCC460BFC30A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdf416820532dbd83f3c4782ba707b381d28021765eb66b9b8d005b1cc30d97c
MD5 af038ae0a852a2bfa03af76f4e4a1f68
SHA1 13ff508d607210f6e148df75e73480891068b4c3
SHA512 5b992f5ee0efaadc41de7c5e58e647957be719d4d9eccc5a74eac881d770dfdfc937a785a7ab9b241bca428dea60d85db4fb26f7965fb5a886ceeca527b4b6ef
TLSH
T10241F95CA7E91118B3B66F5AAFF6986D047ABC372E0AD45D10110E4F0A73B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download