hxxp://91[.]92[.]40[.]118/wget[.]sh

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://91.92.40.118/wget.sh
Sample260708-3fefeaat9m

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280268347264225"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6B1EBAE4-261C-4E05-9B9E-31A1D26ABB8F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5856	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
404	msedge.exe
404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5788	OpenWith.exe
5788	OpenWith.exe
5788	OpenWith.exe
5788	OpenWith.exe
5788	OpenWith.exe
5788	OpenWith.exe
5788	OpenWith.exe
5788	OpenWith.exe
5788	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3192	4400	msedge.exe	84
PID 4400 wrote to memory of 2488	4400	msedge.exe	85
PID 4400 wrote to memory of 1320	4400	msedge.exe	86
PID 4400 wrote to memory of 1320	4400	msedge.exe	86
PID 4400 wrote to memory of 1320	4400	msedge.exe	86
PID 4400 wrote to memory of 4408	4400	msedge.exe	87
PID 4400 wrote to memory of 4408	4400	msedge.exe	87
PID 4400 wrote to memory of 4252	4400	msedge.exe	89
PID 4400 wrote to memory of 4252	4400	msedge.exe	89
PID 4400 wrote to memory of 4252	4400	msedge.exe	89
PID 4400 wrote to memory of 2976	4400	msedge.exe	90
PID 4400 wrote to memory of 2976	4400	msedge.exe	90
PID 4400 wrote to memory of 2976	4400	msedge.exe	90
PID 4400 wrote to memory of 748	4400	msedge.exe	91
PID 4400 wrote to memory of 748	4400	msedge.exe	91
PID 4400 wrote to memory of 748	4400	msedge.exe	91
PID 4400 wrote to memory of 3408	4400	msedge.exe	92
PID 4400 wrote to memory of 3408	4400	msedge.exe	92
PID 4400 wrote to memory of 3408	4400	msedge.exe	92
PID 4400 wrote to memory of 4192	4400	msedge.exe	96
PID 4400 wrote to memory of 4192	4400	msedge.exe	96
PID 4400 wrote to memory of 4884	4400	msedge.exe	97
PID 4400 wrote to memory of 4884	4400	msedge.exe	97
PID 4400 wrote to memory of 2584	4400	msedge.exe	98
PID 4400 wrote to memory of 716	4400	msedge.exe	99
PID 4400 wrote to memory of 2584	4400	msedge.exe	98
PID 4400 wrote to memory of 716	4400	msedge.exe	99
PID 4400 wrote to memory of 716	4400	msedge.exe	99
PID 4400 wrote to memory of 3188	4400	msedge.exe	100
PID 4400 wrote to memory of 4452	4400	msedge.exe	105
PID 5788 wrote to memory of 5856	5788	OpenWith.exe	120
PID 4400 wrote to memory of 5972	4400	msedge.exe	122
PID 4400 wrote to memory of 5980	4400	msedge.exe	123
PID 4400 wrote to memory of 5988	4400	msedge.exe	124
PID 4400 wrote to memory of 5416	4400	msedge.exe	126
PID 4400 wrote to memory of 5416	4400	msedge.exe	126
PID 4400 wrote to memory of 5416	4400	msedge.exe	126
PID 4400 wrote to memory of 6132	4400	msedge.exe	127
PID 4400 wrote to memory of 6132	4400	msedge.exe	127
PID 4400 wrote to memory of 6132	4400	msedge.exe	127
PID 4400 wrote to memory of 5960	4400	msedge.exe	128
PID 4400 wrote to memory of 5960	4400	msedge.exe	128
PID 4400 wrote to memory of 5960	4400	msedge.exe	128
PID 4400 wrote to memory of 3808	4400	msedge.exe	129
PID 4400 wrote to memory of 5704	4400	msedge.exe	131
PID 4400 wrote to memory of 5704	4400	msedge.exe	131
PID 4400 wrote to memory of 1788	4400	msedge.exe	132
PID 4400 wrote to memory of 1788	4400	msedge.exe	132
PID 4400 wrote to memory of 5820	4400	msedge.exe	133
PID 4400 wrote to memory of 5820	4400	msedge.exe	133
PID 4400 wrote to memory of 5820	4400	msedge.exe	133
PID 4400 wrote to memory of 5824	4400	msedge.exe	134
PID 4400 wrote to memory of 5824	4400	msedge.exe	134
PID 4400 wrote to memory of 5824	4400	msedge.exe	134
PID 4400 wrote to memory of 5792	4400	msedge.exe	135
PID 4400 wrote to memory of 4880	4400	msedge.exe	137
PID 4400 wrote to memory of 4880	4400	msedge.exe	137
PID 4400 wrote to memory of 4880	4400	msedge.exe	137
PID 4400 wrote to memory of 404	4400	msedge.exe	138
PID 4400 wrote to memory of 5524	4400	msedge.exe	139
PID 4400 wrote to memory of 5524	4400	msedge.exe	139
PID 4400 wrote to memory of 5524	4400	msedge.exe	139
PID 4400 wrote to memory of 3220	4400	msedge.exe	140
PID 4400 wrote to memory of 2420	4400	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://91.92.40.118/wget.sh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,7117507919509604470,2064848526459176797,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8222828790634557287,3871772863837053462,262144 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,15953316931474748765,16474447285023275404,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3638647205972598574,11289445241292114792,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,7197056362906104620,1791049815692876445,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2093310855861104709,10544571522192087023,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,16146849375122164537,10807716146218561433,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,443995813074662305,10763948949580535170,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6352767317284494146,4955899632813449973,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6771181527895066054,14587585151459162627,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5476,i,9147970396467171609,5399231352618826287,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,224537748298461534,2382117144312215898,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,17435007101675572652,2568792509457540824,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,17435007101675572652,2568792509457540824,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,18111069998752824374,16650668642771897717,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,17626486969225983682,18188854069159762357,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,4326506216013125267,11994684360946880359,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5188,i,13025685352581585764,11574717405710013893,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5844,i,16192006347214463141,18042765129275177296,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6796,i,11595716660037437748,8782883221649184874,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,13292064108783863525,9726657170481385823,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3547829573819816370,11473584695641037390,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,9104693729851255346,10477299579712146081,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5648,i,18439704543253325992,12337736295275302995,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5272,i,6661527325502588576,5216792739044167426,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,4568836157338152730,7313640017636901275,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6968,i,17713931340892130908,4721056502821493564,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6980,i,11503986311830310842,8210144872795410201,262144 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5816,i,618098970148131681,17680756191985242144,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,5870536515276416688,10962165300523451254,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5956,i,3950212466282554778,6475667967506831656,2097152 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,17596492427089094504,13653577050540561747,524288 --field-trial-handle=2196,i,570169233650171704,18126080761270400743,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\wget.sh
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 394KB
SHA256 2081580b46e6903e856f457ee1511c1a89d571a2285e2f227308fafc402db71c
MD5 e24da9195399831f986432b6f5c766f7
SHA1 752ea337bb50fdb53de3893188499abc73982d9f
SHA512 84eba5f2dc92bae33633da4566786c82fa7ced294630aea6fc9b54c78bde40720edaf9583e48b011d7bc2039ce219b3c63b2fa3ba8d0bfc040b01ea63b407665
SSDEEP 6144:UHhGHABxUR4fAGAPF83McRxccQ3TwCeiyTthE8SZuGHc9yWYfBxx+SuxQKt96snh:9gB+PFQ23aiyRhWlAyZ4xh1crH4XZ
TLSH
T1A38422FB5823A4DBF296943579B3C628360C37867E422848BBBEADC10F2D5AC5D453C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c3d9cccedecef41243756380e87b24f1f7d58da559a85390c05c4912cbf12060
MD5 4f696d9b7e00091603187621bff949bc
SHA1 11b1433b1bbd7326d8d1e35a4f8f391c157c121f
SHA512 fce4d7740c831cd8f8f9ea6d56626226caefbca44ccaf6a7a99254cd8543553f2bf436c816a220b49b19509ee1e632fee781afa3bf1b65e60a46bd8c528c193f
SSDEEP 48:mPTRJFoKsWIf77O44olfAWD33TAhMJei5MBNvQLQPQOPFjJEh1Kt8YaWHr7faUN8:sRbo3Wo9RDTKIGCVOYkL7SUNzgcJFy
TLSH
T1D0C1D83081A29386FFD2087051D21B467E738CEDFC17BE0A4E2375797817E91699B324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b4f766ee222489fa403306568f40e441e051cbb89ba368962645b4a498d677f
MD5 87fc9d21260ec6f49e980bf0556a21ff
SHA1 e787dfb98a1d9de7e406237ec077658aff67b0ef
SHA512 d32e827cd3e16706ab2ab4259f1d84d4b568cc84164d85dd8201500481502d79d66a861cd936de9d7c2a05ae45ac04941e22d7cb7e2ed845dc4311b1fed02f5d
TLSH
T12A71C834552A53DFF7E6027290C12355F6328DEAFE273D412F2375B55E01FA08169399
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582a18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582a18.TMP
Size 3KB
SHA256 abc946efcbc432cf4fd5ec5d7b4d4d2c3f8fca74d5aca882dec1504809a2b326
MD5 bebc7b2f95af35f707e192acbebaa766
SHA1 25eb0e4bdfd58739cdfe9c565ea91c46f0b2c26b
SHA512 c9d78bb8d1fee099ced3127660266f8baaf6efbae918814162f5bcc5132a69d707c151c65925ac71201c0d4a591b109aafa6213bbdd194d6751db20869a3e52a
TLSH
T15F71C634551693EFF7E602B290C12359F6328DEAFE273E412F2379B45E01FA08169388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6ae5acb7e09f6cacfeb37981864a6b223aaf699b2412abe1a8e49c1dc86deacf
MD5 640b607bbba7b1aa5e8e0cfc4bc2ae6f
SHA1 691408b108b19939f2ef927906986fb943d09625
SHA512 552443fd822520d423c0c0ab89972ee7a7b2211b20f771b19fea575acb2f52064fad47b9100e941da0fae8874b593b8c0a2d5bfafd2bdb5fab322133a6a2b50e
TLSH
T1206199F2C3E6816DD91195F0AE147F1BCE1D055243AC3D5A8AE4AF4BA7F2461E012B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 730b453a8be85973b769a2fa51f5925e781c3e32d7a8b1224e872b548c916db8
MD5 06dd5d680d98a42a3564b17204fc070d
SHA1 2fd2836c87569082ae3b6e11331a4e69996b7ec2
SHA512 fe8baab36aea406dbdbbfc87339cfb33f6fc2ac59180aa07178c2701d9ece932a73f70faade8fd47146d3f5221091879060ab8379258848fc8d526d689adca0e
TLSH
T1E9819AF3C3E6862DD91195F0AA147F1BCE1D054243AC3D5A89E4AF0BA7F2461E052B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0922ddfa436d5367d8b276ca9dfc836cae3e68088f8352101dffedcbfcead9c7
MD5 77b207bfd85ae54d1e5a9f9e1e5797dc
SHA1 2e5bf38c4c2378c28349762d1213fb6dfa177503
SHA512 39c186615500447a2229236e9057b9a681a6a37b35d060bcc2c82cb3bac9d04457f85ea5214bec9744a8112daddea9f7e0842932a8a147dca5150b0f143540ff
SSDEEP 192:sxZ9QUnJRWyM/jK1Ml8MWPw/fTsO8jUA+bPh1ddp4iH0wK8l6+WNBXE/YIE4vTW3:sxZVnJEuPw/fTsOAUAM9HH68u+/K3
TLSH
T12272F91266341937DCE7D219F9027B93E6F85022D6941E58AAFCCE0C09FABDD2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 04eac2736c8e4985c2aefe7b2c162dba88aeceb69fc7eac743c405f4d5872353
MD5 40431f1d7c4c4fe243b18bc41225e27f
SHA1 41d2b6bba7e566a6132c263c7073ce5787380163
SHA512 1d70307e4e7edd28fb771ba5c321c305834f7c89a62f566f7cd242d0a46633e28dd993d169c9c0de94eee31a81556109f39905d003f92ced39852efc6a6daeb3
SSDEEP 192:sxZ9QUnJRWyM/jK1Ml8MWPw/fTsO8jUzYbPhaddpmlH0wK8l6+WNBXE/YIfiNWIW:sxZVnJ0uPw/fTsOAUCeqH68u+/f3
TLSH
T1A07208126634593BDCD7D219F9027B93E6F8506296901E58AAFCCA0C09FABDD2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 562d3e1b60b84859036b296ac93e0becb9b5f7ef62acd2907b3522d71d629d13
MD5 6997a64845a4f00f0cc7d537f2d27e13
SHA1 0612880a97292153c85dc1f7137946e7cd2fea0d
SHA512 2b7d3c117830402e5c1e1e7a43347cbf96f03f8dad52db78f7e78cb11165c32943ac63faa0fa2e0ad676c2f804c222c98eaed91e314af49d6858ff40da8e6c02
SSDEEP 192:sxZXRWyM/jK1Ml8M9w/fTsy8/hIdpJH0wD6+WNGYIwbNWIgrJ:sxZX01w/fTsyUKJHoGn9
TLSH
T19A42F9126A345977CCDBD209FA557F93D6F54472A2901D48AAFCDA0C04F6EEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 09c72791cf734a0cd71d338619330c4df4f1faceb4cec0ab8e9281edbbb853e2
MD5 89876bc4c360712250786f5f54fc2916
SHA1 c56780b47103e679d398a0c03756614979e40bff
SHA512 a03d699d42d0f23ffce4b78c95c38298b366d6f62f0c3ff7fbaea75a976bca314ac5cbec106fb546633a75a3a4c5ed93263abdb6d538eb9013c2dd39cd513589
SSDEEP 192:sxZ9QUnGRWyM/jK1Ml8MWPw/fTsO8jUA+bPh1ddp4iH0wX6+WNBXE/YIEOTWIg5f:sxZVnGEuPw/fTsOAUAM9HH0+/+JqC
TLSH
T10582E71265248977CCD7D518F9317F93D6F84063DA941E5CAAFCC90C09FAAED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 86fe0360fdde916dab8c2f15dde64602c069e610012f91ff19591184d861b565
MD5 1519d9fdabfe28539616bcd52cc10188
SHA1 8054ac766c1f674277ff77cfc9ac663148462c48
SHA512 f4f059116625f1a6cf01f8fc91ca956d93e6af8d2652359213b3f06dccd0ff03b883ab50e86a4f8c055b021f8882bc8a72fa0b7d2c98158dafb441dcfd8fd5f6
SSDEEP 192:sxZ9QUnGRWyM/jK1Ml8UQ+9w/fTsO8jUA+bPh1ddp4gJH0w36+WNdZ9LqXE/YAN2:sxZVnGEqYw/fTsOAUAM9BHUh9/GJqC
TLSH
T1AE92E71265348877CCD7C519F9317F93D6F84463DA941E4CAAFCC90C09EAAED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 91087eeb3b1f7a17ccb3439db0c8c3ea23a4c6a3c0892d3a25a0e28d89372687
MD5 97c00dd159dbf2399231014d928882c3
SHA1 c4b5759f8b807c1ecca79c29d8d5ddcec9379ca1
SHA512 b171caeb87cd41b63cbeeb6a6a5991151570ef3aeae1d71b783e6be43cabf5c9389bab8a319334bd3c5ada7413dd514b154fd35847b3fbcbfd522ce8c74da29e
SSDEEP 768:5tsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9WroQan:5tsqxXlWvJD6Tu1ja54LAs9tQU
TLSH
T1ABD21C3B694CC77D4F840E6DEC26AFD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 98acd89f1ec7208984f09e8767ae62451de67bb944acc981f0fd387899f8d497
MD5 5b53567b6a26600aee2145d57b5e7ff8
SHA1 ad63fc642c9a2a226f8cabc2a933d7dc652f8f02
SHA512 1b6001f14d370c932089c0c92c998ff90199557f2528343306fe078195a165644b3378af11570ca6639cb61814e0d4dc3b552de1287cee9ba2f316ce3a48e43a
TLSH
T1D2A00256A2900009C14663F4259741922F16DD1E170213098190C194D8615494DF104C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 52c08cbc001905ef78e5d5d3adb4ab7d5fb63d3c174093cc22dee7fa6e67a530
MD5 0509f0f524c423e6ead76deb10c31b26
SHA1 8aa61b544b8a50423e5975c079c397286b5526ee
SHA512 5c9d72cad9be4e0230cc0cf511214bd4829de1eeaa5736766d86307f5f5a0157f96dfec25c0eda612af7b6060dd7a100ecedc1935281de2fd23ffb53bab12bb7
TLSH
T131A0022013849245C11212F6AD9202417300CCA265141747819E70D4DC504C08EC204E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bbfc1693-6097-454f-b94b-dd68c4f3ce0a\index-dir\the-real-index
Size 72B
SHA256 021d40a83709e6ebf0a10f581ff08eca62aa2e6fe28e3fb0cfae09e7842e6f14
MD5 43874b44060964e3d78dd50f80efdeaf
SHA1 c7b908c5315221c712c28a0a2956767cccabca87
SHA512 5b1b181ff857d185aaf03b3a7cfdbb733213c4679c885aa3a014970d44808af2509c7cbd4dcb075f9bf107ad04681eecfd7bf2c1bdd72f9585408fb35e5cead8
TLSH
T107A002200974004AC182CEB0514223B067586D250313D30555B005559A5225C57825F4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e5a803e3-5080-40b1-9f97-0d4f07d3115c\index-dir\the-real-index
Size 72B
SHA256 402190561a4f05a256ade50bac6eed122a841fa11701aac18d8bf253a58bffaf
MD5 795222887109a8fc350ab945c72b4973
SHA1 b7c8d89695b4217068bd6a1fd6aa528c2bc9a360
SHA512 520eed7fb8d2cf5e08800923631a3e3a3f56e668a8edf936147a0fcf8233c07048eee6fce82cde0792cf1b6560a2476c4e46e3d6224b3c71919dc22f007e3440
TLSH
T148A0021A3245D35AC04693755061828467265914A905160E55D8C948D86134159A7009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59287d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e5a803e3-5080-40b1-9f97-0d4f07d3115c\index-dir\the-real-index~RFe59287d.TMP
Size 48B
SHA256 85aab7e0a086c10f7646f4e9e44e0c6e41ee003e392951fbbf56e9d84d6eece7
MD5 e7a88287206deaee78edbe4fdaeab3b4
SHA1 bb1a8f191891196e96bc8f0e31ca5f87ab87700c
SHA512 f17ca83e02a79eb611243c9934abebac86bbe8473293cd2f58e4f2571a05a86a906c7c0c71e5ed53e3e634600790dda274456bfa8fd84b6066e97aacf61f6cf7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 2KB
SHA256 0dde75db238eaba5f33612d476b672e6a61dfaa7760ecde031bd7efbab1cc320
MD5 218e726bd723fcce2b248fdd2d36eb69
SHA1 7132e417ecbd213ae82c2a48e1f01ed4e307b42c
SHA512 935725a53ab76a30d14b2794b1819d42e0cef7e6c880645107e6cb71c24c925962b5fc6b8423d10f88ccd651768a128d6d799c30761b49537a2604a9ddf0e0c5
TLSH
T13A51D78ECC895B8BDC7C71B378BA14C5377A18ED16848E0B99EC6534BCC723C186A658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 09c93c0772149240c2528c91f396ee119947eccf6c60eab85bb92cc2f7ba5365
MD5 411b76ae84ac8ccefdfd6814eacad962
SHA1 3c0a729a408062a942e2484b990bdf52e2d21da3
SHA512 2a6763c442e2dce3dbd1717e23fff56471800836ed4a06fc7dbb9e3a6aa6ffba409671f04e862ae8278e2aa63ef3b85409b02af5eaf3fb2785d3b971ecc2ad2d
TLSH
T1663130CD8E51A99FE4A488B2107271A577B0C8CC6B11E7138C7C62773C2634A2A1B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a3bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58a3bd.TMP
Size 1KB
SHA256 364130e2989b88e77b35c88dfc959f6f9173afbbef218492375443fd7d141ce9
MD5 85492ef0165316e56ac7c6e4c69f2c9a
SHA1 c7b3dbc34ebe89332519caaa954bf4cdea7bd73d
SHA512 e6b6b5d0375f794164a7ed52be7ece65f671d9e716b5bd52c24e2cc66fde64baa9c0f777f115855630a7418bcdb57b21581a3c0ffe0bac31a439651025f038dd
TLSH
T18931728F4A82590FE8E440B60A52A4B83379C840A322B3C3D87D633E6C7579D2E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 36bc66b645a747f52537305ba6099afd7e6fcc4b1182e9fa2be23a731f640b33
MD5 236a0670b2c00c215815ea43a6a525e5
SHA1 ccb251874532381a79559e6c509033c26be2fb17
SHA512 42c31babc9448640aed6d3dcd264acc866961b68d49db16d0af03fd93541aafc6a21ab1877187eb47b6e3006a4d7d2230a1f0a9f18b0428cb46e7e160f68d523
TLSH
T1B3F027777FFB0C18F8ABD2DB147658A10414BC58C892FC5F101AB58794713216869C6A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 6f728e32e87004051f1ed8509504ab9e5acbe476f92f514cde6ef616a5a77de4
MD5 26be95d96a10f878e902905e48772f6d
SHA1 82844dcd1bb2b294bf8ff2a2436b6a6312e0a64a
SHA512 9daa26af7e3c5fa70a4a483599379a4e92c053bd9f3b691d2ecc0baefdbe6dadd3f1db5a8ecb52c71bb53668432a5f3564e9b7065162a39602680ee2e60fa571
TLSH
T1CFF027776FFB0C14F8ABD3DB147668A50505B858C8A1FC4F111AA59754B23246869C2B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d05b16616e53701822e438c901625ec82b4b62b992fd5d304137c5c4ee7308b4
MD5 d9d835400ae67cef0fc786ec59c8979d
SHA1 36f1f642344ed6844fbf41dd6b847a2b7f124824
SHA512 4cc08dfb86e90ed60442a7a779aada623e27fec3dabce08dc2ba72d9803d5aab2fd68c86c0194a710a3c53567765b365d87f436b537a979505243bb1962930c0
TLSH
T15BA00211D9D5D865C04446F490A222886EA1D8DC1A0A7217A0AC00DC8C5055555EA3A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f6de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f6de.TMP
Size 48B
SHA256 e09e3a98d43c003bd6e3226e0b750490f0529e122891376cfae1a56c58b4e6f3
MD5 f8f30e33cfa4889331ddab892a81d482
SHA1 fe56ae6ffb2ae833774158b8939ef77cbec42f2b
SHA512 9f1e3ccab42d353019dca25f55cdeb7e37b986394827e17476f80a8c313bd2259372cd1dd7ba6ee58d594559448754c7a454a727bbd7c61f3ef3f2da8edb4ca1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2efa85f8d8b37e714476542dde3904ed3e1050921281b0b72633a3848f3a62f5
MD5 f273be1579da4cb8e3a844303bdd08c9
SHA1 dfd055a30202216ac0d97454c041bd974b78763d
SHA512 c66df751b806ea12ed4475499b940124c455c91005a8d86bbc73421a0b82df16725c2ad7e618589267d440d2ac5b329febe15c0f3718300c1a4c2dffdcb39725
SSDEEP 96:KYbaKYIKvdCKegCeHuKMk0zc5t7xxNWlqggVNK4sg7NcD7SFR2g:ExCJx/zc5t7xxolqxVHsg7iD7SFR2g
TLSH
T15FB1301A317E0211387D2868B16A99378F813A63701CE46F7FB950A60B6BE114DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58c668.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58c668.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 14281def595c4290c265d9b0652214bf9ed8808017f28000116d2ec59ea556b6
MD5 029a1f4778b25bc78f2e4814d90cdc7f
SHA1 8fcee30357a811a6cdaecffdc6fae06fc9596735
SHA512 96c59e639857c35c1eec70d2fbdb434cfbb597ccbfcaac8b4b74d611a7c15c4073cc2ae432595a5b8b4f349fcddf9bf2e8849c9e1c0925d9ab2eea98755d4292
SSDEEP 384:b8iFNtNn/s3n9SHmsNK8TUNTUlIlmTEmbiXO2VRNmd2OYo0TOObjI9G6w7XU:bnFNj+9xzwgBOUHmR8T29MXU
TLSH
T1A3A27B334C648D7BAEA24A95F54B36178FF481AB9AC93E50A3DD9F0C01DB5EC4306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7c0c14ec62107662aeb6e8bcd1a8e68a0b936711f8019860a97c9d256b72ba6d
MD5 7abae24bf82bc0d2e2af32289cec1732
SHA1 257eae8769dfba629b943cf298a80fcc276307d5
SHA512 6efb9f01a1b18597bc7959a8ddef528ded0c2042043ce50530d356654d55b4f2363b9b808683a511e9826d2bca80a2d27b2130efbe68b0a19179ade42ab395ff
SSDEEP 384:wtNn/s3n9SssNyFZmbpTlVRNmd2OYoxTOObjI9G6w7XU:wj+9XsLHmRZT29MXU
TLSH
T17D92AD325C381D774E935895F04B36178FF4816BABC92F4492EDAF0D02DBAEC431291A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 127a7d42adff6b239f8ab966f4d5a2c357345cdf001e230ee463095e21149c94
MD5 d32f9c147cdc9daf8f0839f67d9a110f
SHA1 5eb0b473dc331ac27272da2ed7bcd6a5138765e6
SHA512 d5d5cad51437f4eaa33450954ee09528ed7d4c895a7f8089da7be011d242d1afc7ee78e8e943cee1aecafe3a49b5efd28219320f61e7a4610da871700c1400b0
SSDEEP 384:b8iFhtNn/s3n9SHSsNl8TUNTUlIlmTEmbq8O2VRNmd2OYojTOObjI9G6w7XU:bnFhj+9JiwgOOUHmR7T29MXU
TLSH
T145A27C334C648D7BAEA24A95F54B32178FF481AB9AC93E90A3DD9F0D01DB5EC4306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ac36227e28a6903f9c6a42d56de1da8bd6d7b44cbad7a67f443a6493d0c0ca00
MD5 e73652bf31a5c1993a9a814df42a572e
SHA1 173a4a54c5f86a152546c57c22deaf0d3b797873
SHA512 ea5c47321010fce9dac507ec6a097b0df3e675803fdf0651eb9a8be17525f2e12e64e8755488e68b065c807c48e341018b64676e3b07f4e82bcf831601f3d78c
SSDEEP 384:b8iFKtNn/s3n9SH5sNK8TUNTUlIlmTEmbGZO2VRNmd2OYoMTOObjI9G6w7XU:bnFKj+9+zwgxOUHmRkT29MXU
TLSH
T12CA27B334C648D7BAEA24A95F54B36178FF481AB9AC93E90A3DD9F0C01DB5EC4306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1bdd392e189158ec7da5dff2e5fd089fd4dc48322ab5c992688ae0d94b2b5167
MD5 dfa5f800c7f286a1aa3d1e4e7ddfdfb9
SHA1 a98cbffa550759ade9eb5c3a71307a6d8b54cebd
SHA512 e19685c7f899d2b68e9bafe43249f7e3d7c0ed5acb2f4bb6643ef63d59b018661a35e024ed61ad2ffc155a079dfba8d850feb8a9aa98f4b495ba6b9bdb66b5b7
SSDEEP 384:5tNn/s3n9SfsNypZmbaTlVRNmd2OYoxTOObjI9G6w7XU:5j+9U1LHmRZT29MXU
TLSH
T12D92AD325C381C778E935855F44B36178FF4816BA7C93E4492EDAF0D01DBAEC431291A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4d4ce969f0d0d80cabfc32f80e8672c6092b6fdd76ae25efe4f92b18e3b8c890
MD5 c50ecee601e2b41200383e398b9bf684
SHA1 f1b625cf9bc0b45ce59653d14579a92f22548bfc
SHA512 f7b10745023081c08d1ed6021dad62b707d0316be58ac9dda9d53016e892abcb978fef72696c824b974b3dc3a22a513d76db05da40ac1bb4ca65931e2130ebdf
SSDEEP 384:TtNn/s3n9SssNyIZmbpTlVRNmd2OYoxTOObjI9G6w7XU:Tj+9XHLHmRZT29MXU
TLSH
T13E92AD325C291D774E935895F08B36178FF4916BA7C92F4492EDAF0D02DBAEC431291A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d163540cc663601844a47cd7145fdb7e4017c936049aa8e9c26601e674c72272
MD5 590181cb5320ddd9cf116363c40ee3f3
SHA1 211d5e8204ceafb7ef56368ae6955e606cc1fa54
SHA512 615d8a4ba94c1d4615b1358ce1fab076bcc3d6210f2abfbb29931a76c69b435304061a63221e642cf5cf6b7a4d49b386bd8ae957a8bc8a08fa667dac9fe492e8
SSDEEP 384:b8iFAtNn/s3n9SH5sNl8TUNTUlIlmTEmbGZO2VRNmd2OYoMTOObjI9G6w7XU:bnFAj+9+iwgxOUHmRkT29MXU
TLSH
T1C0A27C334C648D7BAEA24A95F54B32178FF481AB9AC93E90A3DD9F0C01DB5EC4306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ec3f20cf0a345291680edfa040d33b6f7e85ad82142c16968df7974f6ea864f4
MD5 840db4fac8ce96fcba83d8a0679b7f9b
SHA1 18375f19b0a1c7a8d0260dffe096d585d0ad26bb
SHA512 48a542b1b7be375a1c1fa21a306b012fec103a2227b4a446590589765de0b998686947c827f154ae3d3e47392455276521b1e403cc8c42442b72c800c108e1fe
SSDEEP 384:b8iFXtNn/s3n9SHgsNl8TUNTUlIlmTEmbp2O2VRNmd2OYo1TOObjI9G6w7XU:bnFXj+9/iwgtOUHmRtT29MXU
TLSH
T108A27B334C648D7BAEA24A95F54B32178FF481AB9AC53E90A3DD9F0C01DB5EC5306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 568b1b91b791253490a48aee7d6b417da168759d078a00336f247c812330c155
MD5 f30c5993be03580e7211b9e911b204e8
SHA1 4f6d8c5e4cd024b0c4e9d734ff3e22fdc6a42219
SHA512 166c68f85b25ff4f4be7787faa81b3630f6b3cb8b0512dde1e14761445293f7561aebbfb462bc5f54be1acb1e47ac9550d345dec5b0338d22fea7f44ecf1a970
SSDEEP 192:tON06JkRtQmiUyV2W+RN5+Fd107sh3BRHJU6:tON06UrHW+RNmd28XJU6
TLSH
T18702C935AC382CBB9EF26D0AB58B37135FA4117BBA952B84D6E81F0C01D765C1347926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 227c2dcbcef171207c8f954b8d78ea54bdfa9b2cbaf91936e268166e256232e7
MD5 2a805bfca9987308c7f62e82ea9d4c96
SHA1 55b19d79d8a50f725aa4c9f6521e3a4ebc36de29
SHA512 3fcaa0fc9598fe1c0dfc8cb223705457bb4d847738ce1c4e1bf3c5579388ac5fac4f05af23b6ea119558c7dd4ba72ce074fd6cb51d7f828026a4e6c92c80b228
SSDEEP 384:rtNn/s3n9SssNymTEmbiGO2VRNmd2OYo3TOObjI9G6w7XU:rj+9XQOUHmRvT29MXU
TLSH
T16392AD325C291D674ED35895F48B36178FF4806BA7C93F4492ED9F0D02DBAEC4312A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3d6d098a188df41c916aa7a172a8f4a24d88597f31b399215525a2b5bc7ab430
MD5 eb8dce6669737356fc69d6f0077b23ce
SHA1 ee27fdb21970d09d2e4f2b1411f9874d870944bc
SHA512 20e4d762e4f67bd48e8ccc3c6f9076a73d679888498bc55da55b6b216eeda8900adc1e1e79c009fe43b449a1679f2fff069af73bcd0b3dab3ed7d0a03e7f1ec7
SSDEEP 384:b8iFntNn/s3n9SHKsNl8TUNTUlIlmTEmbACO2VRNmd2OYomTOObjI9G6w7XU:bnFnj+99iwgeOUHmR+T29MXU
TLSH
T144A27C334C648D7BAEA24A95F58B32178FF4816B9AC53E90A3DD9F0D01DB5EC4306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fa4961a5cda10583aca5812ceb4638f153f44bd5a81ca0efcddb777f52db741d
MD5 4cedd9e7e84a70c98bcaba59af9d8cad
SHA1 dccc61a158dc66e2046b0feb3066af11f7b059af
SHA512 324cc7f8f4072fbab3a757e09ef8d797ee80153102057fd4bd45cc79840e4109463e2d9bb4b78339c7de0d951a41a67b851864b3db51397ef95af1d45f2f053d
SSDEEP 192:XON76JkRcQmiUy42X+RN5+Fd107ptpefPwoUIVcTqxxYU6:XON76UsUX+RNmd2OYomTU6
TLSH
T16A120B366C686C7B5EE26845F48735135EA4912BEE897F8096EC1F0C01EF9AC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 be24176987b72c879451cf732eff10f3ff572fc1e5e8d9bba36c5a01862148de
MD5 8a7c6fa1e0cd92a35956d606a3d5b95d
SHA1 0d4488194deed80dac060a35f47d3dfbf261b8a7
SHA512 373d3ed5e6420cd0c71fb112198be5f2285fb16cf267da57de248cc1b506f8a25a8bb71378f61cb4e5fe65814e216783e6ad3967b5d6ab443ed9ac0946c08c26
TLSH
T17541165CB6EA1148B3B37F5AABF7A8AD447E7C772E06D49D00110D4E4A32B40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

kworkerd-rcu.crdownload

Path C:\Users\Admin\Downloads\kworkerd-rcu.crdownload
Size 394KB
SHA256 4dc47959cb6437a9de370647fcc8bc63c2882def695e008536b539152acd103c
MD5 7421638659b5dcfebf10a8a2b6ae7c71
SHA1 4435c18465ec0dc7fbf3ef41aa6bc038473bc71b
SHA512 bcb1587c522e4ecd426dc835b27fa3f2e016fcd8b9a421a1d1033bae5ed166f37fc7cf402e4ab8c0f4d68b216ce26b60c4e1702bc8ec06cafea9a9ed465fe1b0
SSDEEP 6144:F7nSu4LTS7cnSvChIZtwFcfFyni9GTfnrdeXNBb7WpvGeDHG6ydmljryvDiHa4O:NSugS6LF74GXdGNleVmvmlSvDiHa4
TLSH
T1EB84235BB102F80AD84D58F238A3C6293D887F1E67632E08D175E9BC3B495FF5491A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kworkerd.crdownload

Path C:\Users\Admin\Downloads\kworkerd.crdownload
Size 271KB
SHA256 05686c56837324d1bbb9b98c331bd689af81de4a27c52a4d84ace7e25302e111
MD5 54f0648f2e7cee0cb382eec995843eb2
SHA1 d2f5dbec007fc5ab00891651aaf56e1feefd9b63
SHA512 b365355312212dcecd19fabd87f335190665cea31d0c72bd432a1cb5ee4ce2959bb7b48e8d8501d09faa2519795c51a2f60e6e33981fdb43797b1d4a1dc43641
SSDEEP 6144:+Oq94BgLBMx0E/bJghAzZ6DvFc9NqHH9JLOf9E5:VyEgFMx0E/bJghAYvFc98HH9y9E5
TLSH
T1AE445B036580D5BAC487D0B5CBDFA2274961783D5C7A724B27A07FA23F4AEB05B19B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget.sh

Path C:\Users\Admin\Downloads\wget.sh
Size 4KB
SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
MD5 27c926823687337fe491a0578dcee3bf
SHA1 3c11433b0e5a3354dab55eea7b535074e3c11103
SHA512 0de8408bc0c48d1f809fcc6faad7b5d85b574379dec0f6ad030e3dcb07db35528976504bf04c954261c453eda3173424ff077a6f89cc13fc79cca54225078bae
SSDEEP 24:j96f0fs+L+Jmgs+LJlSlLxs+L5M7ldls+L0fxf2Us+LuifibVs+Lcmfm0GCGs+Le:ev5F7Fh
TLSH
T12B8171E6F834A522304DFAFCF217A7848746CEB990BB3601A046AD7301CF558B54DBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download