ac3869c88745c5aa19bce88561896e874f67d86b4d6673141d2c4f034a509979

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afu_toolbar/bjmk.html
Size 6KB
Sample260928-lnjxesab27
SHA256 ac3869c88745c5aa19bce88561896e874f67d86b4d6673141d2c4f034a509979
MD5 a7487269b7d74f02e355f4cffba44974
SHA1 e58487f12fa4a48bbfafff2a69f7d55f9bec0dc6
SHA512 807febc8b621eb11f86fe601c9b76f47ba2c8e4f038464427797e9c403d8658e49f530a58021cff30a15ef9d83f29e882940f62e8fa555ac6f88079994132ad6
SSDEEP 192:Yo8B6sUkdz6T0I7ncx4izcZlgSR2BWPNVU6GsMSqF:77cx4izCgGNVU6vMSqF
TLSH
T139D16354E9403A461633B37483E35341FA76D0938505AB643F8DA3D24FF28A95E6BF8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{E67030EA-D907-4C06-BD21-C42D3CDCEB83}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 4512	860	msedge.exe	88
PID 860 wrote to memory of 1940	860	msedge.exe	89
PID 860 wrote to memory of 5000	860	msedge.exe	90
PID 860 wrote to memory of 5000	860	msedge.exe	90
PID 860 wrote to memory of 5000	860	msedge.exe	90
PID 860 wrote to memory of 2032	860	msedge.exe	91
PID 860 wrote to memory of 2032	860	msedge.exe	91
PID 860 wrote to memory of 3864	860	msedge.exe	92
PID 860 wrote to memory of 3864	860	msedge.exe	92
PID 860 wrote to memory of 3936	860	msedge.exe	93
PID 860 wrote to memory of 3864	860	msedge.exe	92
PID 860 wrote to memory of 3936	860	msedge.exe	93
PID 860 wrote to memory of 3936	860	msedge.exe	93
PID 860 wrote to memory of 1240	860	msedge.exe	95
PID 860 wrote to memory of 2328	860	msedge.exe	96
PID 860 wrote to memory of 1240	860	msedge.exe	95
PID 860 wrote to memory of 1240	860	msedge.exe	95
PID 860 wrote to memory of 2328	860	msedge.exe	96
PID 860 wrote to memory of 2328	860	msedge.exe	96
PID 860 wrote to memory of 4220	860	msedge.exe	103
PID 860 wrote to memory of 400	860	msedge.exe	104
PID 860 wrote to memory of 4220	860	msedge.exe	103
PID 860 wrote to memory of 400	860	msedge.exe	104
PID 860 wrote to memory of 3416	860	msedge.exe	106
PID 860 wrote to memory of 2840	860	msedge.exe	111
PID 860 wrote to memory of 4612	860	msedge.exe	112
PID 860 wrote to memory of 5112	860	msedge.exe	113
PID 860 wrote to memory of 2344	860	msedge.exe	122
PID 860 wrote to memory of 2344	860	msedge.exe	122
PID 860 wrote to memory of 4988	860	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\afu_toolbar\bjmk.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9b085c188,0x7ff9b085c194,0x7ff9b085c1a0
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,1455026659609038697,9656762398934086057,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,5456575878724563275,4731822193750191531,262144 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,17470608410177022844,11179838255228305019,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9339319309890474973,8084367671918861598,2097152 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,9470936673498340996,9849320837002712465,2097152 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8898394033886784899,16951712838188762960,2097152 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,6931432296406907378,1104827517409606091,2097152 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,3308722792639770225,5749771787443132411,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,7070737717531409571,15854283849510032151,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5560882724840040562,16311920816273688960,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5560882724840040562,16311920816273688960,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,4358310963955130232,14089930935844550297,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,16785375100511426159,10362441574094820363,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3168,i,984219955147957054,14320721840682666736,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,3207238885596702544,7253728059160657873,524288 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6128,i,3900182284668546948,5719895212212257536,262144 --field-trial-handle=2276,i,9729591609044389311,10520352039915631319,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b9d15046a1433263cad28413ba36c7002b7290c4fcc670e8e2b0cb282191b65
MD5 930f2bb36cd8a26cf345349033070f75
SHA1 ae5bcdc12428b17f617989a29f948f9e7e20fc64
SHA512 cb7707ae7b7fa0804299258318fcd2da732445f62b8e23cd29e001eb9a83b53b2575f84dbb2cfc3204b2b6636b65eee5a24187046fa1e51843d70394bb714b16
TLSH
T1206183C1A49240BDD79803B0BDDD2CE7B53C1AB966A37D10C59BE43DBB4A3B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c32c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c32c.TMP
Size 3KB
SHA256 e88e62950b466b7b9c5bf155deb88d832523f4a18ba6e0e5b982a72b394325b6
MD5 3766e4a43158d61a507a71b685708f7a
SHA1 dee430e2ff72fec5b619f60027fc7ad446407a55
SHA512 1b0a253503707d0d8016abf2d831c539224dded0253e0790aedac1d5d80bf6d329d3543fe77b6cddb09c44539d42b9cc9bfe01ef759f34a07fbffdd02d5c9b3d
TLSH
T1686183C1649240BDD79803B0BDED2CEBB53C5AB966A37D10C49BD43DBB4A7B412072C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b7bb1d30c2d69bca0e45a4733b7b1562c535ce385da5459839a271908d070b9f
MD5 65607979b72cd4ac103de588e56ba2ad
SHA1 3fe5e9b427478afcfe4fae2d06b0ac2b997650e5
SHA512 aaa1d937e0c36c3254d340e246a2f2e04141f92157e8aad06cbed92bcde840e57f8bbbd796dcc3844a3008c4e62fb18d468a9690005c71698cb8d31256ccc402
TLSH
T1F3117AF3C3D585AFC91116F05A28EE2BCE2D0606422C7C1989D4EF6B97E3475E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a4a7906276e3c7ce47ee9ec64c4346dc3adf60806a3d6b3e8907a2463fe23525
MD5 b4e6041b63e9f537f7bc059b4ed00ef9
SHA1 593bcd85b97ba8c455b2d6372085091c9189a3bf
SHA512 44adeeee785cc0bb22fb67100d7f3cf78295901a74680cb70278ebfa82be68dcc73fdacda5fc8ded4395ac40b0fac13ceacad104ce8bfe3e58b9080d8ad1c85d
SSDEEP 192:sxZnREWK/ffsDrbIdpdiHW6+WNGY3RPDlIgrJ:sxZnFK/ffsnEwHbGs99
TLSH
T1FD22C7116E38A97B9CC7D20DBB25BF53E6F94032A1901E58AAFCD61C05E6ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 445807f7c4bfbbc0303cb27db3e4b528e9dc2d6906a0d4b50045aae840c70e1e
MD5 db1d5304f94b8e69105a4dba5559cba4
SHA1 ccb16084d21e4d1561c4f1ebde01a0a180959115
SHA512 2c59b7f685fa44b792846a4a56400a8d91f2ffc7cd1ce07886ed400acd6f4bad3c42e6ae6f38d7b54e755bfa62ea66865ed956decd64001cb68c9a65e83d4417
SSDEEP 192:sxZnREWK/ffsa/bIdpHiHW6+WNGY3NPDlIg5GJ:sxZnFK/ffsWECHbGG9M
TLSH
T18522B7126E38A97B9CD7E20DBB25BF53E7F9503251901E48A6FC961C05E7ADE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 02472a62a380abafec2a50cdf8af04b6f8a2a3faa5cb714700b1cb1008daf5d2
MD5 079e0c4af044e3f5a4b8f21917f91567
SHA1 f5cb66724a1e33e8949b057f6f3bc3b3dbd518af
SHA512 446d31b26bda4c5f500b16d71c4df331599bc6c072f0d308697ac11e582556e00410b1e4945955df33618e0844d79c22a2fa4ea95b60b014f26e75522c8829bf
SSDEEP 192:sxZnREWK/ffsa/bIdpdiHW6+WNGY3ZPDlIg5GJ:sxZnFK/ffsWEwHbGG9M
TLSH
T14C22B6116E38A97B9CD7E209BB25BF53E7F9403251901E58A6FCDA1C05E6ADE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 4b18e85f9f95d2caf6ca75ebd21a36d0ee3137e8903ec01ab7463fddd5d27cd2
MD5 94bf4c4366fe71649eb1be7db2161d03
SHA1 e27d11be2bcca255e566f7c6ccefb95716471203
SHA512 354637e87ff78df0f650a894367c4e645f86cb5aa41732ec410be949f14ef21ef5495620853ad9f95d507148d892cc8f60810af8795e00274b14aec857b05897
SSDEEP 192:sxZnREWK/ffsarbIdpdiHW6+WNGY3RPDlIg5kJ:sxZnFK/ffsmEwHbGs9e
TLSH
T1DD22C7116E38A97B9CD7D20DBB25BF53E7F9403291901E58AAFC961C05E66DE230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b78b65ffd19f88228a8f01b6b55052444b4197e43bcd88e704fa09e8bad416ff
MD5 1015403bb2e429696849fb55719edbfd
SHA1 420ab9cacb7fc15b012a467e392eeba63bfe81df
SHA512 df481ec32803c4b0b376095bef645ad86a608ee544d30881ff80d62581866fd66b4e3352517e811441fa5a227d2c5fabf62e48164f56701b4f0cb95d1fac72ff
SSDEEP 768:KS30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72BrolZMr:KS30AbSWvS2l9u1jaLmLZ126M
TLSH
T10FC2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9b37fee7864ed7e2cb0da1a75334c4efb7adbf07e30660d681e844afd9b4e482
MD5 f2ec82f56b0096ff1951e63268a6d284
SHA1 7490ca57b8cb68fcd6141775b9197d903c313954
SHA512 c1b1339168d36b33eed89f30529083d106f0eeaa638d388c9213636c584307bb6890015b5d31b20bd6e351ab8a66e5f9e5c3cadd47754ba46e4a544a808b97d1
SSDEEP 48:K06lI064I5bkjUISs5K9Q1K5xipYb8IKyLWRsQO00tbYvAISotK9M1OtxG9Yn4cY:KwhyKSQSmdiK2oZUgKN621
TLSH
T14C91521031BB4240797D794C86B0876E968137733115E62BFFBD04AA4E6EE085CFE6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df370cc6-5a25-4c8c-88d0-a5cfb09ebe3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\df370cc6-5a25-4c8c-88d0-a5cfb09ebe3b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3c82cb63c0e53266dfe9fe3b7d903bea870612dca131ff4c86a5b6457b4f4e87
MD5 84f49a259540587e41af580621320393
SHA1 1bab7f6ba0f61ee758df6c65c3bb99cab8e5f80e
SHA512 e63d8c0ab8e8a303b41bcf7787c426913db01e7fbebcc649b5eceabf5e7555c16cbc4b6681ea9c4a0b6932e962f4b8841811a4deddbfe2eeab15032d2af96e55
SSDEEP 384:OZcIhsNyTznypuWBt9iX5FA+eM28mtgOIwZOyjroc:sh0nTaE+2PXsWH
TLSH
T12C828C32AC789D7B6CF6A551B48736034F788567DBC4AF84D4ED671C02DA5E9030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 25113a09da6aea088e476fc37dbe7198b5cce0e6a995112695e76e25cc4eff11
MD5 556f3a5c234db3d93887e690c4fe4182
SHA1 dab331d96906772c724cd671e4668672b9eca2b8
SHA512 66361d3b44a178c990b7e6f88715737b096cf297f4f05ff5b221480ca25ac89922d0509db89d52a94ef854faeed3bbddb9ac2249ade068e467ad93200f34c9ef
SSDEEP 384:MiFiZcI0qzsNK8TUNTUlIlyznypuWBt9iX5FA+eMH8mtgOIwZOyjroc:3FQDTwgPnTaE+HPXsWH
TLSH
T10EA26D339C68C97FBDF69A41F54A36038FB94167CAD5AB94E6DD5B1C019B0E8030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e912a2805a0e4da3df2431fd5e6fdab8539966adaa0a585eb56ad22f931f2968
MD5 606ba1d5f74801fd6a9be1166015c757
SHA1 99f262b38335d3051aee0b0701abdc47a6f8d3cf
SHA512 31e81184d160ac3d77591a6b594e09b855a491906d61d682bba5ff34d0b26fd93e3f887158d4c7ba0cf5baa59f3e43ed099b0fbd150b5b8adfadac77d0f41b7d
SSDEEP 192:LONe6AmwprQmiUyul6siX5FvY+9Ji88XU6:LONe6ipdv6siX5FA+q8aU6
TLSH
T16D020B35AC686C7B89F36E05B48B37239FA9117BD6942F84D9E81B1C01D768C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0f08b75f205c0326b8dd1f79e8c80ec6904fc6109531e0b34f340b5a5d56b82d
MD5 45e1ffd851d5f63e0a8f853da5fd0d48
SHA1 72bad39f0e7175e7bbcbe840d01e51ca0fd1439e
SHA512 906a41e4b854d5cf61e7f87b9ff63a605b80c57187d47d7eca2b54ad4b597ebe3cc688adeb0fc20d307f7ec283514fe6153fe9073fc20fb3f1532aab634322de
SSDEEP 384:LZcIhsNyyznypuWBt9iX5FA+eM28mtgOIwZOyjroc:ThDnTaE+2PXsWH
TLSH
T182828D32AC789D7B6CF6A551B58736034FB88567DBC86F84D4ED671C02DA5E9030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8de785293696d21dcbb33026d141b4d7743d2e26e1d84221dbabff3a2cc4a62
MD5 9e9424a419027d1ce65abd483bf7e401
SHA1 f00c420ef49975bb89c8760ebc561c024aa1f2d0
SHA512 8d1afc22b323a570be7f374fd30f5feac19d3382ae2635998d8d7d86be1910b9f81bd36825edb000feb543aac8e3e88e0cde77ba3aaf8aa78ff948291fed8158
SSDEEP 192:LON76AmwpuQmiUyElvsiX5FvY+eMSlR84q0U6:LON76ipqnvsiX5FA+eMQ8mU6
TLSH
T1A8123B36A8786C7F5DD2A951B04735138EA9426BDF886F84D4EC272C06DF598430B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42b69966-462b-44dd-86d9-5b2e9fffb45b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42b69966-462b-44dd-86d9-5b2e9fffb45b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 950ce0e17452d668c476cba2db768eceb83d3719790dc508a6828c35549a6533
MD5 82f98aa8b99867452a2fb7135e4d1477
SHA1 5a2d4778aad108e918d2bda13d1acf75a628f0fe
SHA512 53934878d6c12dc62df81d87df137ef605685c4db097e44afab07e0fe022d065645ca400bdec024594a9e097317ba57b12ac0c7c6286795eef79fbb6ff0eab5e
TLSH
T1A0412A98A6ED1148B3B37F1AABF6A86E447E79772E0BD55D00110D8F0A22F40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3416-182-0x00000230E7E00000-0x00000230E7F49000-memory.dmp

Download