hxxps://apex-mw-flow[.]base44[.]app/

Resubmissions

23/08/2026, 16:37

260823-t5azvaybrf10

23/08/2026, 16:27

260823-tx8wxas1dw8

23/08/2026, 16:24

260823-twkspas1cy8

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://apex-mw-flow.base44.app/
Sample260823-twkspas1cy

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	1716	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
172	raw.githubusercontent.com
173	raw.githubusercontent.com
174	raw.githubusercontent.com
175	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319758813820698"	msedge.exe

Modifies registry class 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	dnSpy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	dnSpy.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{36C55B1A-34FD-45A4-871D-F63C4EAD2384}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	dnSpy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	dnSpy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5256	msedge.exe
5256	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4608	dnSpy.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
4608	dnSpy.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4608	dnSpy.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4776	1180	msedge.exe	86
PID 1180 wrote to memory of 1716	1180	msedge.exe	87
PID 1180 wrote to memory of 3528	1180	msedge.exe	88
PID 1180 wrote to memory of 3528	1180	msedge.exe	88
PID 1180 wrote to memory of 3528	1180	msedge.exe	88
PID 1180 wrote to memory of 5116	1180	msedge.exe	89
PID 1180 wrote to memory of 5116	1180	msedge.exe	89
PID 1180 wrote to memory of 3524	1180	msedge.exe	90
PID 1180 wrote to memory of 3524	1180	msedge.exe	90
PID 1180 wrote to memory of 3524	1180	msedge.exe	90
PID 1180 wrote to memory of 4916	1180	msedge.exe	91
PID 1180 wrote to memory of 4916	1180	msedge.exe	91
PID 1180 wrote to memory of 4916	1180	msedge.exe	91
PID 1180 wrote to memory of 4496	1180	msedge.exe	93
PID 1180 wrote to memory of 4488	1180	msedge.exe	94
PID 1180 wrote to memory of 4496	1180	msedge.exe	93
PID 1180 wrote to memory of 4496	1180	msedge.exe	93
PID 1180 wrote to memory of 4488	1180	msedge.exe	94
PID 1180 wrote to memory of 4488	1180	msedge.exe	94
PID 1180 wrote to memory of 3944	1180	msedge.exe	99
PID 1180 wrote to memory of 2864	1180	msedge.exe	100
PID 1180 wrote to memory of 3944	1180	msedge.exe	99
PID 1180 wrote to memory of 2864	1180	msedge.exe	100
PID 1180 wrote to memory of 3872	1180	msedge.exe	101
PID 1180 wrote to memory of 3872	1180	msedge.exe	101
PID 1180 wrote to memory of 3872	1180	msedge.exe	101
PID 1180 wrote to memory of 3160	1180	msedge.exe	102
PID 1180 wrote to memory of 876	1180	msedge.exe	103
PID 1180 wrote to memory of 3160	1180	msedge.exe	102
PID 1180 wrote to memory of 876	1180	msedge.exe	103
PID 1180 wrote to memory of 876	1180	msedge.exe	103
PID 1180 wrote to memory of 4268	1180	msedge.exe	104
PID 1180 wrote to memory of 3884	1180	msedge.exe	106
PID 1180 wrote to memory of 1528	1180	msedge.exe	107
PID 1180 wrote to memory of 1528	1180	msedge.exe	107
PID 1180 wrote to memory of 1528	1180	msedge.exe	107
PID 1180 wrote to memory of 4120	1180	msedge.exe	110
PID 1180 wrote to memory of 4120	1180	msedge.exe	110
PID 1180 wrote to memory of 4120	1180	msedge.exe	110
PID 1180 wrote to memory of 3520	1180	msedge.exe	111
PID 1180 wrote to memory of 3520	1180	msedge.exe	111
PID 1180 wrote to memory of 3520	1180	msedge.exe	111
PID 1180 wrote to memory of 4788	1180	msedge.exe	112
PID 1180 wrote to memory of 4788	1180	msedge.exe	112
PID 1180 wrote to memory of 4788	1180	msedge.exe	112
PID 1180 wrote to memory of 3092	1180	msedge.exe	113
PID 1180 wrote to memory of 3092	1180	msedge.exe	113
PID 1180 wrote to memory of 3092	1180	msedge.exe	113
PID 1180 wrote to memory of 2412	1180	msedge.exe	114
PID 1180 wrote to memory of 2412	1180	msedge.exe	114
PID 1180 wrote to memory of 2412	1180	msedge.exe	114
PID 1180 wrote to memory of 5912	1180	msedge.exe	116
PID 1180 wrote to memory of 5912	1180	msedge.exe	116
PID 1180 wrote to memory of 5912	1180	msedge.exe	116
PID 1180 wrote to memory of 4044	1180	msedge.exe	117
PID 1180 wrote to memory of 1908	1180	msedge.exe	118
PID 1180 wrote to memory of 3456	1180	msedge.exe	119
PID 1180 wrote to memory of 2956	1180	msedge.exe	122
PID 1180 wrote to memory of 3456	1180	msedge.exe	133
PID 1180 wrote to memory of 3456	1180	msedge.exe	133
PID 1180 wrote to memory of 2672	1180	msedge.exe	135
PID 1180 wrote to memory of 2672	1180	msedge.exe	135
PID 1180 wrote to memory of 5256	1180	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://apex-mw-flow.base44.app/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,6521786938311676681,8032977372832981714,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13001589470252589313,1038846369074911001,262144 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,6365004099332146755,8089051109358005011,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10558490598329104539,7276033659802010975,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16173555799389702899,3787520890173612864,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5842912018845112567,8220088584354481330,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12694597069718483945,15712421462217428622,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14335211326985397220,5789333029203033125,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2816462674488384025,18162666126987958486,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5708,i,12684980878458184582,848543861546401955,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,13534782777383210969,8396654448163175641,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5940,i,7662085788697808520,6375620386481275947,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,11020562622199851215,8622044516034623673,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,402184286993120263,287264851267318849,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,402184286993120263,287264851267318849,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6808,i,11618530141630283809,17016275128983968198,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7128,i,3193094036225655104,1564467353949720286,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6984,i,10188798306948223175,14157589656394531849,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6800,i,14231735333861648518,853203524250248770,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4304,i,16437383338724874759,9819680327652835412,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4440,i,6587598874314618604,18289546809643236859,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7668,i,15649393653360261943,4136777790838416316,2097152 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,13732413167293467232,5380092755966738137,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,16517755649883423037,7588463817327520672,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,8193880277088963826,14346392159696398490,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,13873877516045891543,13838318398194197262,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,7108557557890142806,7726477014171242610,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,17672670620612873582,17371644488014009296,524288 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6788,i,14936622715848433016,1920204501520738619,262144 --field-trial-handle=2472,i,10173516877931421963,4072576612593741761,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5612

C:\Users\Admin\Desktop\dnSpy-net-win64\dnSpy.exe
"C:\Users\Admin\Desktop\dnSpy-net-win64\dnSpy.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58890b12-69ae-4d70-bce8-f1a0c321cc62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58890b12-69ae-4d70-bce8-f1a0c321cc62.tmp
Size 392B
SHA256 1e575cd898103b6a85fb00451395bc64e32e939dc86f0612a071de53943661ab
MD5 876ac20959ebc2872f2b4b64b6ca0ef5
SHA1 886b8400cf1ec0e2c66ad85a2ea62969ba4301cf
SHA512 3341d4e85a043c227ac1dc16ccd5bcdddca84e9c14d535dd17643bcfa040d24f576c5c1ca3af7310a78db0c22d2bfdb2594c013d50ee32c9ecaf75e05b114410
TLSH
T182E00203D31000F7C00C0339048356115AD3857402F3124D5E2011693C22B002D71F80
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 33KB
SHA256 7b0b7abe7f4cc2a8cf9a1ce70fb3b5b355d56ec55617d89059b21bdc384fa320
MD5 af644b2a43309f33a734cb793673002f
SHA1 2a523d97c1abb65af88e5bb6394e9bf4c68c985c
SHA512 d83ef0260947d8c4f9a76dcce8480d7d875df58c7a1fa3205127b574c9f91d854b93c61498d480a8c6bec3e2c4d4fae329010f7d5e125a0daba0163a1d428546
SSDEEP 768:t0jypE37eSL3EDukK1WoJ5BRElIO1EtSJ3WRVxSi/B5X3EoD/:8FL0DXoJ5BRU1jJG3/B5H/D/
TLSH
T11BE2F24A7A167796D1D002C97BC573B699C6E3475DB080034A226E5CBCFAA0F072BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 96KB
SHA256 e39d4523548f394b03b4c070951eeab8d7b0efaac11b82f1b079455007655eb5
MD5 b7118703d910d40fdc2dc4a6d9818197
SHA1 4d49920d1b2808cd29af6fc3cb240bf40e13a976
SHA512 78d565e7c057966d4e675a11a0e5e1f93fb17305a2bfff0325e02feaf4fa611d613d2342b85f11288645b32ff9fc948f708dbab119c419acc9c9fa5e9d411154
SSDEEP 1536:HJjVpQFDQk03oEj00yugbXLuZOSHxGYyEU4uzEoZYuigpmoHSyB0X8vQ+t+8c:HBVpQhWoELgPugSfyE0zdYKptt03+tW
TLSH
T17CA30291612DC1F696F48F9ACE8627041C7A2263D4CC13629AA998BBF030DC769FF175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 408KB
SHA256 59a916af750e4b4ac7f772bc724ae347b33dbddcf3bb86ef6ebfdf386e93b52c
MD5 f12d6ff4a0cc39d5735d4d0f55bd72bd
SHA1 86571d29330b29b5bcb3540c949a0467c9b84b18
SHA512 87dcb2ec26142dc4e0d8b59082f4d050921c388f3624afdb16214e50f8311263355c0f2a61c7df5fee7b6548fab2c19e32b31dc9c64b737a672bd15aa00fe910
SSDEEP 12288:StXvB0Ht2XnVbZqlucOHZpbWkb6O2MWY7YkR2qcKX:SL06nVOulpbTB2gUy2qVX
TLSH
T10C9423782A9F0C88F9596364394898C7C33421017AEDF19C77BE7911BC7B621B392BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 68KB
SHA256 2d63bc3b50a5a4710adb7eedcd824e7091ea595c4fa64fb1b74d947e88b2655c
MD5 6614f8d1bae78718b10c0092d7487709
SHA1 c89c991bf8e4ed3a420173b4140e8f67301ccf90
SHA512 b3855f28d6facba240978c348758e0b798a9fa20ded30089946db404d82459da983175f59382c66707b8caa7fd2766b733aa0140377cb1dcc0a21ff0ab2de471
SSDEEP 1536:nrhJ7HaHTZCwCIqxoZ96oA2UGRTMvPBH81y/15uMUVtCLyRty:zHaHw7MBPUXG1C15RxUU
TLSH
T1BE63120D182ECF1B5CDD506B97F843DA7C786C022968A7B5FC5E17084B8B49FB1E8668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 77KB
SHA256 aa97fd6d8dfe3acd2e8c0be8d4114f6bd262a8086282573eaaa163a0604d075b
MD5 977d3d28cfece79a7a92d4e0e0dbbfa0
SHA1 241d83a5d00698bcd386a4928cf53c606ee98dda
SHA512 9c0666a6d68bc8c41fafa79c96c14dcf266127ad137cef5803473ef52f62eebe84872db7a6fa1cde15af9d5c8ee22b329c1d01aedd5a3d962abd89774b5111cc
SSDEEP 1536:vkcugu+BnnpLguS1wWc27rhNsJBBr3kcOhsk7MZodkMzPL2WxecMbsZz66:vkPJFuSWONYBicOCmqodkMDnecMbi
TLSH
T175730258AEE2882BE1A21EBE7189D01D7E655224FB2825533111C9FE70E7DF821DDA31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 60KB
SHA256 da9ccc6f173123e866b7c028a8cbf6291ee690a2668632d6e7c5580a39a73f25
MD5 d50c83e3a7238000d6154bb3b40c2cbb
SHA1 9d2ac1cd5568fc9d77ab690af0606adc6400b4a8
SHA512 d7bff51b2ce00f3f6667f1a42108709e0486e16293d2a1095c99cce09160af7aa7b3c5879dbafd165554f9fb1f097d9624999198072b6ca7c3418587ebd0f95a
SSDEEP 1536:TSdcVxNLsXuCzizS3TkCWJIap5ObPxP4Kt:TSdcVf2u94rm3pEC8
TLSH
T1B85302E632262FCCD22118FA957197CEAA207EC5432B845DB5D2E1439D99B2F8E7C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 72KB
SHA256 0156b2821bb7e6a980a9d531ef5838af7879b36860dfa3cc91cea563111026fd
MD5 dbfa409037c32fdc18bffa76d752d5be
SHA1 72ac60c333e6c0f681ee0cfe1ca12b306dc684d6
SHA512 8b156ec696ae87dd88ffe6cc8148c92a4a8467685fd901e41f1b09dd72f9eb1bcfe2c1cdba2cf631fdbe4fd7472ac253ed9d6c3956b8c23559c081fd6f541853
SSDEEP 1536:LQtrwYZn2ARCxwLaZpDsODO9K9mhO5OGQ2RuwlKDiGO4o5AkLPr3PGCe2Os7B:AXZn2YCAYbDQKT5OGP1lwD9QD3OCn
TLSH
T16F73020763FE83F1AD3A09AB8716653209C5582CD66330D872836D6CF1EA0C65DDEC9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 6426d015097a37d569531becc1ca926716be8dccbd56e3fc47c9a698b24a0d4f
MD5 f0a16a69e4b40922094e6d9893dbbaaf
SHA1 d0a73a8eccaee22b3391db6b27e004dd7334c51a
SHA512 a654e848cb9c18172a78d374c91ba4de9ea1056195dbffd1f309f20a26be9b404343b207357eac72f6ed3a3ba0d13ebb7326e5abac771f211fc808b68dbcb84f
SSDEEP 192:90S82RUOlwUzG+NkGUBMwkg3njzMAMf+PW+V:922RYNGKPMAMf+nV
TLSH
T1F422B62081DD349EEB318EF5EAE12CA43A718F5F37CB3E92406059BF2D167921CEA050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591822.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591822.TMP
Size 3KB
SHA256 9104035b869c908d3dcd7c5d3780c844897f0b354c9e5692d1f1220695fe08a2
MD5 daf3e25b6c2b3002b56ab55777969261
SHA1 c65c9800f8ec964f18ac00196e9efa3af4cdbc2d
SHA512 8a6bd429251f49d4e2c5bdb395127b25b6b01b3d63e548d6f1d4246d38188e2cac2b7fb72066227bfe4e9b7e33408099e68c058e655d8aa8bf90531d1a0d5db9
TLSH
T1BD615F5A03C240FDEB301378D5E00D013571CFBA2ACBBD9452A498FF7D06B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e01a9b5394c190edca3690fbec7f9df9618ccbb0349804f76e9feb5f6df4e33c
MD5 fcee73e813d1f4eb6b5bdcc54ab3ff21
SHA1 a8dff43c129e3fc1d707f549d66d4c12f625afe4
SHA512 c638188e0ba2701e204a075b3a1b5eb01b220a0c7327d62e922c2adfd982ca6c2d25e0955dd92fcd379015a0e822b0deeea7ca808b9a5151fce3e01552014f43
SSDEEP 192:D9j7lPgr1uJLmOmJIPR1uHYz75gKCtcm0i3GmrmOmDmt0tkmgme:D9j7lPgr1uJLmOmJIPR1uHYz75gKCtc+
TLSH
T100F17BF7C7E5862DDA1155F0AA14BE1BCF2C05158328382A88E4AF4BD3F2871E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 9823eefc89936a8accbf0157e650ded1686c6e97f8697f7d6a1297817bbd4efe
MD5 8ba4611c1ccfd518ed52bcabbb8e32a9
SHA1 429b6e02ab836b7630144843f2f4da8c3bbc87af
SHA512 07e73ea91ff2b07415765ab9ceb7824a6c8e2eab8f45b2c7fcb5d77aa9deda5930e62f25d61d26252940de034e0a8768ebf31e8824d765040856dbe82acc440e
TLSH
T1E5D022231310F5B5AAED7EE5416AFC8FE32600640903DDE810D0A89E163247C0D072C8
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58db77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58db77.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3b467e8394d10783877b695d9ee4ac30c6048a7b6b1d4cf9cef9932c634af3fb
MD5 839121e72df71dcfb54808b3f916539a
SHA1 d6fe5924fb367020f3d09f3d0e9cb0b1403c78eb
SHA512 05344dac1054546a9f6f58355209ed38e0eb77ce85ece89f66bea867bac5b8ebce172ec306880b016648d0a9215da9753691bcbdf7e6d2f1457fd3a38d9bfa49
SSDEEP 192:sxZcRyyM/jK1Ml8MWPC/ftsWZ9GAAdp7r13yHW6+WN88I9qRG4/YwBPtt1IgNJ:sxZcwuPC/ftsWZ9G11yHbROz4/hX
TLSH
T1B052E9116A34697BCDC7E209FA51BF53D6F9842292940E84EDFCD91C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 a6de892b43f301194913956460a6f9689168dd975a6e31bbc0af59c0273c17ce
MD5 abba4689647fa214e44ae6ed42946bf9
SHA1 f7fef4de113dd40272b8978496da827a7b3d4415
SHA512 22ef816f29fe56c38590166c3701096d621df9d0ed22cbe578897a70887bcd6cc0dc50d607879d63ff9349978f06959826fd49c7a950649685de140a46fde0f8
SSDEEP 384:sxZswqmWC/fts4Z9UqcJTqfHbTdOz4T/SF6cpeK:s0PmWC/ftZ6qGOHbTMMTcpf
TLSH
T11C92E6126A20997BCDC7E119F961BF53E7F844228A854E8C9AFCD91C00E66FD2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 8fb18a76498dc372274b326b09ec1df7f10f5077cbf6d8fcb1509b33e6f06ce2
MD5 c6d8c9afcf02c39565faf362ad64d015
SHA1 b40f2f4a80a2304c87239ae7ff07e2d466ebddcb
SHA512 f50ebe9ac704b73f93be42f950e04999103b1b344c11bfc98743ad0d2da831e3a4c928048c85e6bee405d84339cb26355c80d7cb4200d7e05728b15b898ce480
SSDEEP 384:sxZswqImWC/fts4Z9UqcJxqfHbTdOz4T/oF6cpeK:s03ImWC/ftZ6qcOHbTMMlcpf
TLSH
T1DB92F7126A209977CDC7E119F961BF53E7F844228A850E8CAAFCD91C00E66FD2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 055ef47485b486765ac3a63b6f8d55925a9854b38d6322275277b3e841a9ce3d
MD5 7d408d13401dbe372539a69cf75da55a
SHA1 5e7c7e08c9fa665ee5e238570789f7a9ea9ec711
SHA512 4920c734f64cbf5af2ef20ae50bc4d12704d596219e1adb15fad0aed47e2e4691909f1ca5ae8d4df1cf75886fae199156b44a377c518aa03b49cc4c347c30978
SSDEEP 384:sxZswsmWC/fts4Z9GwcJTqcHbTdOz4T/GL6cpeK:s0RmWC/ftZkwG9HbTMMDcpf
TLSH
T13E92F7126A209977CDCBD119F961BF53D7F84422CA854E8CAAFCD91C04EA6FD2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 96f796f1b031f505a0e84974300121111921d035b990b29103bc2d17054beccd
MD5 5797ca306cfcf96dedf299da69621680
SHA1 acbcea6ff8cb08ed501902e689d90a9700e7b585
SHA512 1a2b77f9e7484a21554ecb2199953758cb3b63c6331fd22cd406e4453496855b56ad615c803f3333ddadcd55982002b44a1d4dde06f1000b947b4722ff5d064f
SSDEEP 768:cd4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dHrohac/ae:cd4jeXmWvmKLEu1jacPLZQdUzJ
TLSH
T114D20A3B244CCB7E4F844E5CED26AE976ED801CB6A588D5047FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 759df27368b42e58e2536c8436b25f96a260acdd667a7b1569e35bc5002fc67a
MD5 379913489f24ada6af6fe707d5bbaee2
SHA1 d5a0d8601539661004fabafdee0abc7fc1a5f579
SHA512 883cf3641ff09c51d5d6fde2ea37a33a1af646b9dcb50d9bdeec5a58027e7536bbfe9b7fe1b349bc870f4a6eb88987ef7e37efe39f4cc7fdb53a7b0387426acf
TLSH
T15331674A8E95ED5FFC544472157774BC7370C9CC4721A3234C6C21356E1635E1A5B2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 d1b34d4f899901b0406f2f9a05e430e2ad698881a0cc3959ef507f389a0584fe
MD5 faec74fa47ff99e49cdfc67a2b237819
SHA1 ab181c284c57db72c23ce5d73ea9bbd10cda33e8
SHA512 86b731c63cd46daac6107fe60c12ab71552814616043fff2826141eda91533bf31817b60625f5153b90bd212ae157b70ba65d97b88e0e6921ba3f2b7e79e1eb0
TLSH
T19951C54F4D4B2E59C9AD01F320FA1D81377528EE47544A4B69DCB175B88332E2C2EA59
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5891ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5891ea.TMP
Size 1KB
SHA256 a9075c8aa2dd58b0b5d248f0213b897a103ea66a4eb9eba989111165366c1c0f
MD5 773524e042e52d96edb4421b9039d8a6
SHA1 ed4ad3958d257eb215169b9c9dc5aae46090e744
SHA512 922959936751c7bbb8013b8ada2c67af21c93bd4201882ac621db8a34dc6648c3b58d0d780cf509559aaf1d230599ab3b87e08aa6f344b772f754a9248100ff8
TLSH
T1E331664B8A81891AF884507B09A6B4B8737698408311B783987C6139BD21BAE1F5E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f51056c41beebfb6860458ffc32f5de96372506427748b5199158ec7a38fb036
MD5 bec0662c9a98a94fccef2e4c415fc6e3
SHA1 8ecf65da40a63f4f29991481e9a9cda13a1fdcdd
SHA512 1c5ecb58f266afd92b52256af6f4155dd03d99de1566da97d90c1f3c1990748b2176e3b7264fb10f4646fc1e151d80a5e096984957d6d12308629f0ff38471c5
TLSH
T16DE0D8FA2DE72E20AC7F47E628B245A44156F469C555AC8E2416A2E751A02682016C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ddb29d06ff28cb6fd3a955c79ac8f2ed4660e2dd5a8a53bb219a16771ec1f228
MD5 6a09859cac7738002d1632d19698d3f3
SHA1 1bc75a6811297d0a367c977c5cff896b499bfbf8
SHA512 699ca8c8123d69cff3e439ca299da51c12951b299a72915f6b0c2a1496544b64c047f8a683d5df69847c633ce035ac6dbae0dc83750d859008a2a176fb8c2dd6
TLSH
T15DA0021189999166C46112B1A0B901C4225088DD07AA223161AC10988A64F4081E2208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fcab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fcab.TMP
Size 48B
SHA256 ab34078daa01d0d1560049ccede8de013cf800e7b47acb9908aef8bc2a396244
MD5 61c834a57e5f5f0980a782cc02abeaa6
SHA1 6a97c482d35ccd1d101832759da93bbea0db60fb
SHA512 6db4f7d7e1f739021a03e02c3283f7869f41bfa62ebd3f2d87a56524ae71631cf5a460eaf38798be2898e8c518c2ba5ce135482747f21426c0d80d155ba0f96e
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b551f3a57b8cb844cb973b9bc9027ed3b65754ab9d839f44851ed68aaecd39e8
MD5 89f221c2da043b2df86e759e75110bd8
SHA1 f8dac7908636e1086b1ee3613511ad3b0b512724
SHA512 46ee8052a18c16653a2df71739bea616c4e4d43ab7c537d4bbdbb0c32e0284f8d90043272fa9e6bc1bf119957a70c46e902b834966e8cae199691e7aad952ab1
SSDEEP 48:K8mIfKji0vyWmTKGQ44+GItlInm+KYLA0+suu1Fk5/vif7plR8pVYnIwz8KfpXxg:K8mQKjiWe9eKmwx/w4KB+Wqz
TLSH
T11D91688170B786012C3E2A4CD1A5962AAA81B253386D653B7FEC00B31E67F518DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5954fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5954fc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b00ea5a8530659f403ed43d972a9e703511d8f09672e6b6bdfd486032624fba8
MD5 535fe2b5d92c25ff840812dd8e28e07e
SHA1 b5cd2fb41e29c6594652f74c0f348a421b9fc041
SHA512 88b2b1f6fb4ed3487fda5839e36ec11039c917a53691d54f693d3a2b7f264340e8a2cfca03ba571f3be80eb06f1758676c9b1a074f84a476f386fa4a0ed34a5b
SSDEEP 384:IZcIhsNLTT8wLSV2f+g8GYZX4+2fbFDivo+aYoN:2hb5VmU4lRDiwlYa
TLSH
T10E827D315C78AC7768E2E245F54626139FF8D0279BC96F8495DD6F2C00E9AA8131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 71c91534535333f069d84cd441ccd4e917f7f8b2ee5ef7c6e77d5d3dc7a583f7
MD5 58ea2531c25efd84c1402580eb4d8b56
SHA1 4d6a3e7bdafefc5a5e3a3b9aec3f85f8374599aa
SHA512 6b4a3d1e62fe92550c145e03699143b4e535ae8a948db8451fca7cca36f10a6c633e180f3f0b6e2de3af9acf6f377fe7bb74806658b600e67a164c7e860625d1
SSDEEP 384:nZcIhsNLqT8wGNgf+g8GYZX4+2fbFDivo+aYoN:PhkzIU4lRDiwlYa
TLSH
T180827D315C78AC7768E2E245F54626139FF8D0279BC96F84D5DC6F2D00EAAA8131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e7f19ff49ab03685f1bb887b051b2baaf038304f97c5906842726c44c53879e
MD5 e55b4b50216428905d591600ecd748a0
SHA1 f8f1da9e0776d2d905d61f57689e96d88ce1b999
SHA512 7008bdd259d600044f7e8b76730fc0b1e3a37451944bbdae29e3f5b88da70334a742d30c88d6a4a044320a291e3fd962c7f8aefd400811a4b0efe3b30d511184
SSDEEP 192:EONl6hZ0QmiUycqpc/+jVWjzorGYW5wOZnlnU6:EONl6oSpu+g8GYV2lnU6
TLSH
T1E202DB35A8786C779EE2AE45F48B27235FE4112BA9D56F84DAE81F1C00C769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e2ea712d4dc551f4f191d5616fae89f44f0df2a5000d80290ef139024e40a85d
MD5 a6afa928caae01509d714095a771a67e
SHA1 3f1ed920bcd545d451fbc44f1afa9e644c731680
SHA512 6a248e0579f81afd57ed0decbe4e1e186789b377510f681d2f638f762f72971cd5d955d1ff56a1c5fa326823d8948c27ea3c82aa04fbbe7b74d4a4f24e1b06d8
SSDEEP 384:riFLZcIdsNV8TUNTUlIleT8wRY9gf+g8GYZX4+2fZFDivo+aYoN:GFTd8wgvP9IU4lrDiwlYa
TLSH
T124C21AF248D79836E8AD9747E77D2D128EBCC017B5856A40B7885A1CCC965BFD30AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b51b46355660418c5fd885733e6e0a252920c4c3d5160cfcde31d5f65db9c6d1
MD5 42170cf8c220104a916d984c378aaaa2
SHA1 dc3e8a8fc094e502119fe362266086911e04dc01
SHA512 6a6fa7adde763265782fa9f0df40373ab0e261a751daa6f3d43beea4742a4557c4947f322cfbf536b9cf16e1985a8ef04c0f58516c79378124157ff174b468a3
SSDEEP 384:EZcI6sNLeT8wRNgf+g8GYZX4+2fbFDivo+aYoN:i6YgIU4lRDiwlYa
TLSH
T1E6926D315C78AC7768E2E245F54626139FF8D0179BC96F8495DC6F2D00DAAA8231BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a18e4892cf728d80725f1690acd441065a4366a7772171b875a3ded071c0c5c
MD5 09b4f8f4a9279c1c87eb24ea2692370b
SHA1 96a7087fbda8b8f071d6028e8effaa16b3957233
SHA512 810637e22cb15821973258a2fbb9ed4363cb1aeedd6246643f4d8835120820b9eba6445eb19eeea539ca53da09916992ee0bb19aefff1f693d2c4cd32f3a6947
SSDEEP 192:HONG6hZVQmiUy8qkc/+jVWjzorGYZX4+2f55cOqFqWU6:HONG6PYku+g8GYZX4+2fs9DU6
TLSH
T1E312F932A468AC675DD2F655F48736235EE95117EEC97B84D6EC2F1C00DF6AC130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b2f3c56889876e3b9df2850549954ebede27431460c5969b550b6299eb63956e
MD5 008d9e7ebc02b304b4d644b899e2b5b3
SHA1 18f6e3ed76b287df07dd589ff7f1d4bc72050210
SHA512 955344c91f2714b28b76df605397e6e7199a311a0cca99f837a9a4376c159d55d76e4729e8309f4ace5a8ddaf1a6bf78a56e9296700500830b55e58411212c68
TLSH
T175E00103D31001F7C00E033904875B216AE395A402B2129A5E2011692C627102E71E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58bcd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bcd3.TMP
Size 392B
SHA256 4ddb94bf76dd82a48c1dd25725a4e702121fc8ae95120534ad98c1a50ad4eb4c
MD5 2204632b3a207d358b915ef2858ef618
SHA1 8ed1b5f0371bfc09324e7c08f8fe31ff5bd547ab
SHA512 c6e8f63fb73ec618ddd3cd4d982cd9fac26b671d124246009afbdc4805a21d0822817e25d864625f49683619ea2b047c5d3d2c934fd1d588d1aaf680e34d56f2
TLSH
T14BE00403D31000F7C00C033C0443551145C3417401F3114C5F1001553C13F001D70FC0
MD5 SHA1 SHA512 TLSH

Submit Download

e0a8b668-aa8c-4287-8c68-dd550c24542c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e0a8b668-aa8c-4287-8c68-dd550c24542c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a1ef39e9a0cdedcd818c13d5472361e096947113a36f3f02aa145ee8d472734
MD5 8b538bc898ae0a6df625f7a76d762a44
SHA1 0792b683eb18e0c6a78f283a49a97f0599100cd8
SHA512 b57a76d5dacadf16667bcb176b01f2e52daacbb53c843fed8f446daa50c871c1dc1c293b63e92d161b90919890464b6d1d4c1b8012a47190274f9e0a519334d5
TLSH
T13E411658BAF91115B3B37F1A9BF7A86E447B7D772E0BD44D00010E8F0622A40C9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

MW-Optimizer-v1.5.3.exe

Path C:\Users\Admin\Downloads\MW-Optimizer-v1.5.3.exe
Size 2.0MB
SHA256 db00e7cd5c8fd61fd470072d7c8bf7f7409d5bec7be9c30c4774a31c58ac1e9d
MD5 d37fd23c80673f597ae915dd00051db6
SHA1 d6fe9a97a5eaf46ba270750a1f92006c40eb1241
SHA512 90cc30c7bd7e5efa54ecf87242d2fc9d435190421a6426af20f919b5c01f38b5602b8de2ba06452d16cabd09b56910ba5ccf9b4dee3d7b09374c287453876f84
SSDEEP 24576:xBvP0wRBt3XHz2RdTJDuhsEIXUb/uz0fBwGD7GuDMMeXUs+oThiKTuHgmKsSSG4o:jRBt3XClYbGAjvIXnNiSvm3S4o
TLSH
T16E95233135A89C31C5690136889B5F067F713C630229A78D73ECB2D62F762934E7EA76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download