d9729b75ddaac7b9b21c62ccfbfbd12edb0619ab04da3d0cfaf1ff31e77dfc41

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B.Z.M -ϐ_W𓥔jI-/GameFile/credits.html
Size 4.5MB
Sample260810-ba41bsssf1
SHA256 d9729b75ddaac7b9b21c62ccfbfbd12edb0619ab04da3d0cfaf1ff31e77dfc41
MD5 9831b9e75e0208ce0dacb6db23d4acbf
SHA1 065886a77a6eafac21c5c297bfbd4d2cb50751b5
SHA512 27d57e91c41fd4cc000622daa7a404f9ff40c95589f5ced7d7beaf5336b4480ef1ffe972928794c76fabdc923b787bd6673191e1c5a1815d74b9438695637e99
SSDEEP 24576:8wEBqmnLiLIi2hrErjKvMPkUoVAwurQBzun:VcqmLAstCuUcBq
TLSH
T17126D56BBB49037306F282626B4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2212	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307972761386395"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{79723D0E-D96E-4622-9023-9B02623C8058}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3336	3196	msedge.exe	84
PID 3196 wrote to memory of 2212	3196	msedge.exe	85
PID 3196 wrote to memory of 764	3196	msedge.exe	86
PID 3196 wrote to memory of 764	3196	msedge.exe	86
PID 3196 wrote to memory of 764	3196	msedge.exe	86
PID 3196 wrote to memory of 1972	3196	msedge.exe	87
PID 3196 wrote to memory of 1972	3196	msedge.exe	87
PID 3196 wrote to memory of 3872	3196	msedge.exe	89
PID 3196 wrote to memory of 1600	3196	msedge.exe	90
PID 3196 wrote to memory of 3872	3196	msedge.exe	89
PID 3196 wrote to memory of 3872	3196	msedge.exe	89
PID 3196 wrote to memory of 1600	3196	msedge.exe	90
PID 3196 wrote to memory of 1600	3196	msedge.exe	90
PID 3196 wrote to memory of 2708	3196	msedge.exe	91
PID 3196 wrote to memory of 2708	3196	msedge.exe	91
PID 3196 wrote to memory of 2708	3196	msedge.exe	91
PID 3196 wrote to memory of 3776	3196	msedge.exe	92
PID 3196 wrote to memory of 3776	3196	msedge.exe	92
PID 3196 wrote to memory of 3776	3196	msedge.exe	92
PID 3196 wrote to memory of 3240	3196	msedge.exe	100
PID 3196 wrote to memory of 2460	3196	msedge.exe	101
PID 3196 wrote to memory of 3240	3196	msedge.exe	100
PID 3196 wrote to memory of 2460	3196	msedge.exe	101
PID 3196 wrote to memory of 4100	3196	msedge.exe	103
PID 3196 wrote to memory of 3792	3196	msedge.exe	108
PID 3196 wrote to memory of 364	3196	msedge.exe	109
PID 3196 wrote to memory of 2472	3196	msedge.exe	110
PID 3196 wrote to memory of 776	3196	msedge.exe	112
PID 3196 wrote to memory of 776	3196	msedge.exe	112
PID 3196 wrote to memory of 4184	3196	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\B.Z.M -ϐ_W𓥔jI-\GameFile\credits.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa301dc188,0x7ffa301dc194,0x7ffa301dc1a0
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,17898941430164675113,5214920654906297922,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16714162333012188539,8553198756498042110,262144 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,14589439891481196151,9775256787425047972,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7241148396657153525,8202854904904193762,2097152 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,18429067473835869910,9054421438030297710,2097152 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,3809433623380505065,15186076912376445037,2097152 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4065171939039382298,14710213102400024666,2097152 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,855008389914447978,16390830831905750378,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,12083924808546363994,7724766674114814679,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,9297713961443630102,16183409724435056151,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,9297713961443630102,16183409724435056151,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,17476313417599190337,15888677118983530638,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,14766673379904205480,18369914047119064927,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,8791460269608955570,7659169842573758487,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,10584321380280305504,10336595082979187169,524288 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,2760237146744613030,16595039655728006833,262144 --field-trial-handle=2188,i,12613177058613437021,2669499580586057055,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f32186789ee213531ec433fa1c5cad713becba6a5aa80fa79a3f92353346366a
MD5 a33e0f980e52b6a95a4305365dae3acd
SHA1 71e87ca2a27596079965077beadbd02e4909156d
SHA512 b693c97cb43dd6f64b27f799a07b487cbd1977bf758b2b9b2032c5035a5b2b4972caa7f937242b35349de8ab8db6c77aec1d0001b6d9d804ead4b5b77ce2f460
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7W:fwUQC5VwBIiElEd2K57P7W
TLSH
T199B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d7cde8df14f8e39f8c08d39ef5d7191bc4fc640ebe92c8f41a359b153128807
MD5 17a341015d32c632871db97951753ece
SHA1 a62db238a103aa903de3abaad9d0a64e63fad327
SHA512 aa681e4ba3162210ecdfa09971e76c19826117ce473899b62195dd835c333895b3860fc0a83af5168f2ff12585adcc12a61acd29f3b29c219203470428942f67
TLSH
T10F61C5183EA24B51F3320933E0E91235357C41B48D33DE55C290B47D9A17B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a718.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a718.TMP
Size 3KB
SHA256 49086c7d91bbb5c00edaa5a6b792944ed7d0cb4873ff10223db26782b94a6069
MD5 cf0300d8f195567f0c4cb9e0146ada89
SHA1 1bf183aef1869fa1535c00a386cb771a910abef0
SHA512 fc8e5a1ce12e18c47b8b04a0a0041f92486da337d6a47e5425dc80cf3f01434182b91d268f39943eec97da759a787f0677ba88ba506d711b471273118c134c71
TLSH
T15461B5183E924B51F3320933E4E91276357C51B88D33DE56C290B47D9A27B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f39c62b91e718c30232d2367c90e1a1b115d7a6c6c0bdd7897ddd45a9ee7d792
MD5 f15a4eeb7d3e5f4e2df5e008baf0074c
SHA1 955678439124ee5d42dd29986ca64af8ba1867e9
SHA512 739f7b681e060a37b16bb801b3146b93104256b1c8461a6a0356b7c80868147ad8127fa8c7d2fc6446d1f24daf41c734cce8db83283c711497c985d8e9594c5d
TLSH
T1BE115BF3C3D5956E890557F06A24AE1BCE2D0605422C7C26C5D4EF2B93E3475E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d35722149088102d1734a482efba3d9ce73d970e5e14b0b9b9cb196d6a5c0b66
MD5 a34b0d4b3f92924d28279099451f0db1
SHA1 cf6eef0e4e15cfc8ae4b760a33d78d3123435135
SHA512 6fa642bcd8ac5c998a3706e0c40a298637559defcc727ca58eb121f45bdc12968b34b8ad7cb23cbd670d9785684d2c7cd581777631034241e0904dc7734d16f4
SSDEEP 192:sxZPRtyM/jK1Ml8Mkf/futsNnSAIdpd7HW6+WNGYLzzkfIgrJ:sxZPPMf/fgsNnSBZHbGP9
TLSH
T10242F8116B346977CCDBD309BA45BF53D6F90472A2940E44A9FCD91C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fe946334fe6c2143ececfc63a8661222612e72ac000f799922fb51441dc186b9
MD5 a37166bd99ee7291b35479a6fe06314e
SHA1 b09d2e2fcdbe5c9b4eac4eaa67816e5ec46b7792
SHA512 c0815c6bec90362d12aa7ae6d1e7cd5632c85c27ecd434e854ebbca6f65ce737f2fbced482926903f4190b152951d229dea5366e69ef797a0825d6a07a96fdb8
SSDEEP 192:sxZPRtyM/jK1Ml8UQokf/futsZGSAIdpH7HW6+WNGYLKa+CfIg5pJ:sxZPPqLf/fgsZGSBbHbGYh
TLSH
T10D52F8156A346977CCDBD20DBA41BF53D6F9047292940E44AAFCDA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dd6db609a5479d9d220a478d6efcc7281dd53ef638f2a18a22d482b0c7644f4e
MD5 8ef1e27d40c5250b06fd8cfcbfae12bc
SHA1 9703de1b8f62dc542eabeae94b0c2bd1d4d44c7e
SHA512 00fc88c7f1b34454ba86cca31931aeaea3ccf8bd747ff32f718ebff715dab4664eb0f4e6d4612bcbad808cbc1c1963e4c6b8ef0ae8d706b718b4648b7f48a1b1
SSDEEP 768:z/s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNwroOB:z/s6pD1WvxzWju1jahILIsNbOB
TLSH
T196D2EA3B680CCB7E4F841E5CEC2A6F967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0de6ad7692d0dab03525828c2519c65c693da043c6bd9723ee3fb411fdfbaa48
MD5 400c1cc0e106db9dd0a9d29c00fa2691
SHA1 db16e8be61ac36d18a0996c483637eb14491ef7c
SHA512 db1e646806c321879be1a824760b15ed9ad07885ed55c3943b1b7c0697e01b81292bb885a2ca3891dbc14e9d2260a13c76195043929b51caec0a4fc07a26bcf7
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFy5IZKakkzyzZ4NJ7nzkDn6PI6BkK1Bc:KUAAKteP+y52KakSa2oKDi/
TLSH
T172A1F10632BB12433C3E2958A294C7279746B1B33058B82B7BA811724EE7E345DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c4979c1-8079-4324-969e-5058400f2011.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6c4979c1-8079-4324-969e-5058400f2011.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 00d371fc41f741c57dc2bc0e1dbe1c150daad3fe4cdb34992c4930f40cef47d3
MD5 d2640dbfefebb35d5f1ddb5ff2cb01f9
SHA1 a9fcb9b85efc9ffa555ab12bd0bfa9243eb7e979
SHA512 6483f1a5f47d42a00154a7ca1ac409d9c2030039baf1682833dee583085c009b42c8b106872d1c036298e271f678ae9e6fe76606db33d64fdd421730b395cd76
SSDEEP 192:uGLsNKgQzAE3y7+3v22QmiU1kuCB4atb0oO2bKh2GkF0SJrbLMAqpVk34EEB:zsNKgMZ35F5Cua91ONMGgzJrMlk3Ba
TLSH
T163422A3168385C7369B3A241F58736239FB98067DA8A2F94D5DC6F1D01DF6AC234BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3ec24fdf507bccc639145ddbb4fd97d41464b98f5e0ca03207d2a47218da6333
MD5 4bb2d67e8a0423680396d34e8a4c5075
SHA1 fa7fcaccf5317df8058d89134ff1a019630d288d
SHA512 d40b8054a448311a95d784537dc54239adda23224808480819bb528dc5108ccbe06587e0f6af4a16a93076c7435b5d6306bff179e51664260a1c0c45905e3234
SSDEEP 384:hiFiZcIZ6zsNS8TUNTUlIluMZ35F5Cua91ONMGgzJrTl6HlytEDq1/CUl:IFQAHwgNZ5aPO5EhTloy6DqZl
TLSH
T124A27D3248A4897BADF7A641FA8A39138EF54077DAD56E90E2DCAE1D00DB1EC134FC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cacc5c0ac782978795ea4c06842ae7f3182982dace305eaeea0336abb0075d69
MD5 80d8a154e863b78db4332f14a7c9ef9a
SHA1 58958f4b6105342701f6f79bf8ecaa75bf48cc38
SHA512 4e40f0ea3d564c2d954fe551b6f8974e87233c7e896113fb54bfdaa943eb723af48e7b28dbcd490151640a4759519681a2130890ec70623b04ecfde5368be210
SSDEEP 192:qON86O7+3hQmiUyAqGttb0oO2bKh2hgGQ+RU6:qON8612Gt91ONMBrRU6
TLSH
T14802E9356C386CB79EF2AE05FA8737235FA5113BE9952F84D6E81E1C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2a9eb4498840365e98332e374ad0fed21cdca68d3891d9582ce77f4ecaaa3d77
MD5 5db7265f4b1477a1131c0391e4aa3f8d
SHA1 c674678acf3289a3d113fad0b6b275daf4a85815
SHA512 ef4d3723413cf57c010e1bb2b9c6ecef2d80d72c26c92a822237353d8d6aff5a83d45d3c0047afd43101bcc3661e2fe1fdb6d17ebef27051ff33b73f37b2eb7e
SSDEEP 384:9ZcIhsNKuMZ35F5Cua91ONMGgzJrMl6HlytEDq1/CUl:lh1Z5aPO5EhMloy6DqZl
TLSH
T135928D3158785C7369F7B141F98A39239EF98037AAD91F94E1ECAF2D00DB5A8134F819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1050a06dfb0a0f9241329c45ce69f381d50a86ea36059d1654e62bc37ef5055f
MD5 a36b1b3f149617e80dbb6ddfc9290db0
SHA1 f61b15e6dd697dc2e67530ad58c30406ed9d1c45
SHA512 1673c2a348a17fb0c6eff401d8ffe7ffea2e01b5b3b4f2f42a16bd4e8e4c3b6a3c49facd4845151516c6d807dc99f88f7d7d613af67bcbbfc7b35cdc5c7590d6
SSDEEP 192:3ONr6O7+3jQmiUy3qVttb0oO2bKh2GkF0SJricNAqpVU6:3ONr63NVt91ONMGgzJrblU6
TLSH
T163121B356828AC775DF2A541F98735239FA5413BEE8A2F90D5DC2E1C01EF66C238EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 14394fa5a5be23b825abba029fe04ace619a80f66eed375ed814be294d2eb723
MD5 b392a4578d9e66cf81d37d51f475279e
SHA1 743ccc212292aa4e0a18d8f847864ade35354bbc
SHA512 4d3df7eade2b2ccaba7f1ddcbbe01b9cad0f2158fd7946bac25afba7c29ca487c5c806d57b9f0a582335be6cb646115afa0f9bcd367d73f86bec88f19cc296d5
TLSH
T137413D58A6FA1148B3776F46ABF6A46E487B7D772E0AE45E00110D4F0A23A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4100-183-0x0000024D30570000-0x0000024D306B9000-memory.dmp

Download

memory/4100-182-0x0000024D30570000-0x0000024D306B9000-memory.dmp

Download