hxxps://mega[.]nz/file/7E1zTaqC#mYfT1DJfPU6GgHwJBGV27EqrWsloCm_vMBjJnadYRFg

Analysis

user interaction
yes
max time kernel
329s
max time network
331s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/7E1zTaqC#mYfT1DJfPU6GgHwJBGV27EqrWsloCm_vMBjJnadYRFg
Sample260922-lvyddsdc57

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5380	cs2shop.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2120	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345443643309569"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{A2A8E035-775E-4846-8BE2-77AF0CA59DC3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5380	cs2shop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5380	cs2shop.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4780	1588	msedge.exe	86
PID 1588 wrote to memory of 2120	1588	msedge.exe	88
PID 1588 wrote to memory of 4352	1588	msedge.exe	89
PID 1588 wrote to memory of 4352	1588	msedge.exe	89
PID 1588 wrote to memory of 4352	1588	msedge.exe	89
PID 1588 wrote to memory of 4964	1588	msedge.exe	90
PID 1588 wrote to memory of 4964	1588	msedge.exe	90
PID 1588 wrote to memory of 2100	1588	msedge.exe	91
PID 1588 wrote to memory of 2100	1588	msedge.exe	91
PID 1588 wrote to memory of 1728	1588	msedge.exe	92
PID 1588 wrote to memory of 2100	1588	msedge.exe	91
PID 1588 wrote to memory of 1728	1588	msedge.exe	92
PID 1588 wrote to memory of 1728	1588	msedge.exe	92
PID 1588 wrote to memory of 1836	1588	msedge.exe	93
PID 1588 wrote to memory of 1836	1588	msedge.exe	93
PID 1588 wrote to memory of 4580	1588	msedge.exe	94
PID 1588 wrote to memory of 1836	1588	msedge.exe	93
PID 1588 wrote to memory of 4580	1588	msedge.exe	94
PID 1588 wrote to memory of 4580	1588	msedge.exe	94
PID 1588 wrote to memory of 1060	1588	msedge.exe	102
PID 1588 wrote to memory of 1060	1588	msedge.exe	102
PID 1588 wrote to memory of 3484	1588	msedge.exe	103
PID 1588 wrote to memory of 2936	1588	msedge.exe	104
PID 1588 wrote to memory of 3484	1588	msedge.exe	103
PID 1588 wrote to memory of 2936	1588	msedge.exe	104
PID 1588 wrote to memory of 4988	1588	msedge.exe	107
PID 1588 wrote to memory of 3468	1588	msedge.exe	109
PID 1588 wrote to memory of 3468	1588	msedge.exe	109
PID 1588 wrote to memory of 3468	1588	msedge.exe	109
PID 1588 wrote to memory of 1532	1588	msedge.exe	115
PID 1588 wrote to memory of 1532	1588	msedge.exe	115
PID 1588 wrote to memory of 6116	1588	msedge.exe	117
PID 1588 wrote to memory of 6084	1588	msedge.exe	116
PID 1588 wrote to memory of 6116	1588	msedge.exe	117
PID 1588 wrote to memory of 6116	1588	msedge.exe	117
PID 1588 wrote to memory of 6084	1588	msedge.exe	116
PID 1588 wrote to memory of 5156	1588	msedge.exe	118
PID 1588 wrote to memory of 5380	1588	msedge.exe	119
PID 1588 wrote to memory of 5560	1588	msedge.exe	122
PID 1588 wrote to memory of 5568	1588	msedge.exe	123
PID 1588 wrote to memory of 5588	1588	msedge.exe	124
PID 1588 wrote to memory of 5936	1588	msedge.exe	133
PID 1588 wrote to memory of 5936	1588	msedge.exe	133
PID 1588 wrote to memory of 5732	1588	msedge.exe	136
PID 1588 wrote to memory of 5732	1588	msedge.exe	136
PID 5380 wrote to memory of 2504	5380	cs2shop.exe	137
PID 2504 wrote to memory of 5772	2504	msedge.exe	138
PID 1588 wrote to memory of 5628	1588	msedge.exe	139
PID 1588 wrote to memory of 5628	1588	msedge.exe	139
PID 1588 wrote to memory of 5628	1588	msedge.exe	139
PID 1588 wrote to memory of 5960	1588	msedge.exe	141
PID 1588 wrote to memory of 2052	1588	msedge.exe	142
PID 1588 wrote to memory of 2052	1588	msedge.exe	142
PID 1588 wrote to memory of 4300	1588	msedge.exe	143
PID 1588 wrote to memory of 4300	1588	msedge.exe	143
PID 1588 wrote to memory of 6108	1588	msedge.exe	144
PID 1588 wrote to memory of 6108	1588	msedge.exe	144
PID 1588 wrote to memory of 3820	1588	msedge.exe	145
PID 1588 wrote to memory of 3820	1588	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/7E1zTaqC#mYfT1DJfPU6GgHwJBGV27EqrWsloCm_vMBjJnadYRFg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa1396c188,0x7ffa1396c194,0x7ffa1396c1a0
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,12192737178107852953,14069844073854662814,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,17152092083482852445,17099316978328245673,262144 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,1640982492873340581,1490738273885046108,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9216768390372222648,6356007200927060702,2097152 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14543626350746096421,14192141011344413934,2097152 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,11706951662954248824,16028166691709638213,2097152 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,9035411515937110069,10392672720181161608,2097152 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,17889160731755094792,14871710166386816025,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,2848166491211042760,10964675885338775759,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7791015995583168673,17895739459974289165,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,331470173361085164,7133712645654009442,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,331470173361085164,7133712645654009442,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6200,i,14489968960780517431,9814982847842926311,2097152 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,17410675155941907023,3803662123511236910,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,11298174400484137164,15697180886834737059,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6740,i,11241731201984260222,4633290057371754992,2097152 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,12166206980583189415,18412198550803766984,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:8
  2⤵
  PID:5156
- C:\Users\Admin\Downloads\cs2shop.exe
  "C:\Users\Admin\Downloads\cs2shop.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/MonsterScripts/Jamal-s-Services/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://github.com/MonsterScripts/Jamal-s-Services/
      4⤵
      PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,3918951387735822952,14581119918491833421,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,4401569529966727533,17921495174735725988,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,8849413258577244722,443424812985555589,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,487117186442911871,8596908136494422889,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,6894354531794303218,453609643555931642,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5492,i,11582038017321675745,11462215062106081487,2097152 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4400,i,2076613346563806276,12653591481848313634,262144 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,6479711163901895440,17300232118720958333,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,5930905165603952390,4830790348868852543,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,12362642748976226412,17745820380166187,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,7118541551924029811,13117707369589889171,524288 --field-trial-handle=2436,i,17100351397714694586,17104619046939035510,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 718e335aaf0cc2bdb22a08afad73b602e427196c2b5718e32d0a88e87cdf353d
MD5 1bdf1da79be0e0ea20bdbaa07b18237b
SHA1 9b391e8c8aa1c7d5fd9789565a3558d0ff93356c
SHA512 f4d97e4f34115e2cacd1714bc7996da96652fa528c13bd8c14fb45aed174b28f4f54d18390d51ae69c70786fa518e4f91b5236e65ac1c73baa48f79a2eb89331
TLSH
T180E0208804C4C31DB74CA657416CA78C8390371A92CC6A4E27059588740108467816D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 70db49544191427e5d8b5d9f46b23b9751ca56b1f239e151f070205a850c92ee
MD5 72200056a9487946e8e244c2d58c22c1
SHA1 8d9e7cc0b8499bd4a103d5d64fff052ffab4e690
SHA512 470503b51a535fd5dd83af8617c99cd8e195a500ef96d8cb016c1fbf445c340cd12ae3d24528942e05a0d3da503a3e1a3870ec3460408ce74145cc34f2a78f85
TLSH
T196E026F89AC8C2BEF31C645B427C6B0C8A81370AEACC6B0E1B44D9847245044E2D26D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 416KB
SHA256 1f48acc4d59f78e55afc425ce42df25f951f43ba0897afe8bdd75afd1c406dd3
MD5 36aa56ac2b293e261e1287dadb20bbf5
SHA1 609d8e7c42a0c45b7de09038b838110d40cf379b
SHA512 449ddbfa4164e4ad3282f2b3b77eba5dcb4819cda82f32b9727adf25878f4cf9559d03adafb7c9818e3a888d1a3926a38eaa4e9aeecf1aff985581726b2b5198
SSDEEP 12288:B+Y6M+btTswBmgdPziea3Ve85BPbm8mWD/np6IN:g4+hsFgJzi5lpm8m0DN
TLSH
T16B9423F410820367E846F87B2EE5D81D424FA6D5F2591409AEF18CDBD1435DEEBA20EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 69KB
SHA256 481bf47ef94a2fe3b1bdcbb51472d87d409f52963abe0388bdf352a86ffbbed4
MD5 bd441a3df3d33e426fdb01426dd90f22
SHA1 204d3d669cfe63ae96316e509a01db2da8c8a981
SHA512 3500cd3142737fd4d02ee5e279a1c6381593cd03eaaa74ac6fd3712364e41ce99ffb70ea20b7fdf20cab55a8328754c306213b05c2eff374383ea7697a254255
SSDEEP 1536:ZhF+10aBSq/Squ3TaLVvkYiUDh62/XG0IsP4psLdmm6DyDtv:ZhxaZv1iaTlIsQpsLJHhv
TLSH
T15B63028A0DE53763C20185FD9547AFE0A9BED0EFB8A4207104ED8FDF27C2817766A945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 027febe32e6c3aa31e7102579e67b8122afa71725b11f9b8525a923d507c12ee
MD5 b72c86836c22cab6a37462e325f3345e
SHA1 1a5a395b035103acbf7cc0d771ceba5845ed3097
SHA512 b90cc4eed0be3fdbe1d764ca1f6235b0e26c4ac89eef9a6b33691865172526dce59cae911fa855dad2c1bd67b147c24a07041d6d45b527e94e5aa2202918fa91
SSDEEP 192:nsqglg2KReR58u44vwS+SXI5iCo3q0/Lq:sqglJL515zhX/Kiq
TLSH
T1F5E182859BA0E191FBD970B5F0EAAB3E3DB758CC4C533E42B59BC6341C66780414A4DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 09167044464a30649af59cf2da434942553a557b3402ba03fcc3e9ba0eab4f66
MD5 0f5b312515f5e8d9ce2fffc06331853f
SHA1 0585bd5b7b3a926ae9669fcf48c1f4a234e89c0c
SHA512 84861d7241a3bb2cea96500171a9aae09b5a7d8921702667a89c0d882d353cf448f7fdb4b4827b982722a70cd23ccf2a81216ac5b8cece9f44c15d1eba3a68ee
SSDEEP 96:3RxHB29j8axlKxbyNdbu5q9SmbeQRt/Tr38rS9pseI:f09QajWR5DmbxRZTrssM
TLSH
T1F291FCC199E12494FFDEB0F1F0BEAC4F39E7884C59621B53F49AC6146CB72D1824A85C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59096c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59096c.TMP
Size 3KB
SHA256 55525ffe19da54f98fc1e38a5eb6d8e0291d4677c413e417045f90768842fff5
MD5 be15d27dd1b729d23a46fcae37d84f0b
SHA1 59b506454dca7b71b5488a9af7229f217b9ca5c9
SHA512 413a52137828d63292cd2d219fa22cb5db55fc85b2d7872d0b94d12ce3aa21edd6048617f7da8966827a24f0b5a5b3b3220c1eeef5afb6c2e6074fa8d9912337
TLSH
T160510882DDB040D8FBDA40F181FDD18F36F74C8189832E92FC6BCAB85636764924A05C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e41f676b6d1a23e54252a1d779c1a6fbca7365ab0ac46622b897ccb61fb3ccb8
MD5 d8d66cb0f28e8d5fb75ee68a44e3ac22
SHA1 eeb507023a65daa97cc363d63b8679838d22840f
SHA512 7df13ffe8a380a0e89738fc63b2d2aeabcd61126a04ed431b89b7015b1059bd1c965d7fec11e10ef086d59247f2e8661420d414462572a68a4738d2f08dbb4b3
TLSH
T141719BF683A6816DDE1195F09E04AF1BCF58005243AC3D5985D4AF57A3B24A1E152B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7de0afa873702015c69d36e665707acf0fbfae41ec6baec7ef8c1d125d1f641b
MD5 25313536596bfcf5eb30b96d63fad85e
SHA1 54d43918bdcbb3eb5b50dd96ed211dcc0a9ca377
SHA512 a1fcb85d6e37af151a8ead62105f12446a32797412ab377b32dff0f713c5a7dabaddb58cb46840e9c42fbc8b6f999bb84d035d4e4cbd66e1d12c38a671b3594b
SSDEEP 96:DlOStwVmUkjzBOBqLj4/Qc5GORBnp/H9tjqwBmtmnBmDmbGmO+mH:Do6wVm7j12qLj44c57Hnp/dtjqkmtmBy
TLSH
T1AEA179F783B2856DDE1195F0AA04AF1BCF580152436C3C6985E46E57E3F28B2E152B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 855f29ce13bd20a46e9fa51bd6e62b16c5a1ed89769838c53a5d5c93cb510de4
MD5 75655473e8f2f30b26c3bac40a18d7f6
SHA1 42c9ac6d1fcd11b39d5b59ad86a418970c0dd11a
SHA512 a138b3a33a926a4b9334974434b461c99f665fc5f7963c62edfc033f56c7d4b23e9c4d2b13f37b4b2f1dd24d856d2d4cfbd791453cfdf2957b36a3fe1637cb2d
SSDEEP 192:sxZSRcMOq/fgstMZkbmzdpm1NHW6+WNQywqZ94/Yap7DFIgrJ:sxZS/Oq/fgstG/sHb284//9
TLSH
T1D342D903AD28A57B8CC7D11DBE15BF12E6F9503796D45E98E6FC861C08E67DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b8463f046ff67e6ae4b1f07207ab0f76c17c9e4a0f070a2a7c78de7be793686f
MD5 3c045103d7a030f4fefbebdf68c17e89
SHA1 dbe717d58c519707e98a64f1d1159f6001822d55
SHA512 8c4deb28a355071ad1f386e26ad792caa8354166d50bf88f3c9cebe8791fb2fcc5436aab48f669fb643d3ea5a00259b3823c26d3dc279efeeb237a6e9e09011a
SSDEEP 192:sxZwRcnq/fgss+jbabmhdpvyVmNHW6+WNYk4DywqOlXYapzDFIg5OJ:sxZwAq/fgssilVzHbwF5X/s
TLSH
T19452EA07AD28697B8CC7D15DBD15BF22E6F9403796914E98A6FCCA1C04EA7DE120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4d5d10f6bfcd6664c314d4f8c6220f882175a2cfbb0bdbc849b4aedc83099556
MD5 720991821e81d10cd47bd238203f658e
SHA1 4281b2168b16167122d28dbeb7bad91725eb3d69
SHA512 509899babc61dd6f28812ffc4df20c1731750fb6319d96731de95a641cc41d7bbc4b2f998dfe84b7e34d76b673eae7f6c4862315765a231f9a27e6ce41d47477
SSDEEP 192:sxZSRcMOq/fgsyMjbabmhdpmVNHW6+WNQywqOlXYapSDFIg5cJ:sxZS/Oq/fgsyklVUHb25XW+
TLSH
T1C642F903AD28697B8CC7D11DBE15BF12E5F9403796D54E98E6FC861C08EA7DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 5c56dbbff11e69ab3cd085b6ef53fb0babb8a140b04b1f402168f96f9dfc1333
MD5 580b4710c9ffc7701cce420e2248f9a5
SHA1 f8513147e505ba3d79872882eacd06381dd1a318
SHA512 30302fd14a05656fc6c1aa3d941a2e327101e74d0dcc415a6d921a6216ff1830be41e77a12d6d202ab72d09dc7abddafc7b5c8dba2cb6df07bc5e82ed5d30407
SSDEEP 384:sxZwAq/fgsr66s8qMpRiYnazAW8pZS15posJWeT+j6ilVzHbwF5Xcc:sYAq/f34Mnc7WeT+j6i3HbuJ
TLSH
T1ECD2F606A814D87B9FC39C28683D7E33E9AC406656C5CEDE56ECCA1C019D1FDAB47853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0c48fea458c158e2e941ec9312b10d2e841de7186b5e8da01c3d4b836d75e655
MD5 c87dc2eb354961189f896a0853eba162
SHA1 633dfbbd7db0b39221e4d1fcf8c732872913d5c1
SHA512 504e7ebe388fe45f676f2d3a608b6605ba336954391a7cc971b31bd04c56b64c3aad17c739ad3ce8d614ae83612b5440cb0cdd37ba56cc49478b8e46b73f4c54
SSDEEP 192:sxZSRcnq/fgssMjbabmhdpmVNHW6+WNQywqOlXYapYDFIg5OJ:sxZSAq/fgssklVUHb25XIs
TLSH
T1A442E802AD28697B8CC7D15DBE15BF12E5F9403796954E98E6FC861C08EA7CE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b2ebbdf8b6923a1b6ad7f6d5f615c27649fdc669c78ec03d57f4766498a3c99b
MD5 047143b897c1640a4843769c9b20c622
SHA1 a907c86fe26950a15517211a4ac95e727718e5cc
SHA512 07f2102c61351666a511bd66acf615ad829794381e1206ea5c7ccc853ab5e2c39fcf153f961f3241691f794cd5b538dba40d9a0543ee19b8f5c2e979369f54bc
SSDEEP 768:GuWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Fro4bfejmRb:GuWPcLKWvKeEeu1jaClLiF7+4bWjmRb
TLSH
T184C2EA3B640CCB7E5FC01E9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\92daa25b-599d-4195-bf05-3ba4aeeae7e6\index-dir\the-real-index
Size 72B
SHA256 d8dc7f14202f5a6404d0a36072710e9c79dd032415ec4b7ad17061cce7218c5e
MD5 9a277f8b28736a5b86c8355cf9e4caac
SHA1 ff2a8391b6031fedf3e9008bd1a9bfc270ba2352
SHA512 97a9ebf8dc8a09ea1cff15135dcdcbd57f39fc974878776d7717faf9cf9b8272e6dad337462ac980f06018c5f1b1edbfc849afcbcd1e4af7f98a0ef5ccf0d84e
TLSH
T1CEA002146A910942CC5237B47696B19D2722CD545B51130769A0045ECD605C55D4604C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\92daa25b-599d-4195-bf05-3ba4aeeae7e6\index-dir\the-real-index
Size 72B
SHA256 9ca00a8758fd1651c27c43fbac404f2e8f835401408bd866fea8fc77beb9346c
MD5 297929f37be0bd1545a53890ba5fcbe7
SHA1 7d23cc122db54f458019435033f5140b6affcaa8
SHA512 308fdee8b0001ba3638612971293c0c7e2e29d08e3779b5d30044bb7efa927c14ccc0f112b508c5d2762f148ac326d1bf6b42e1cf637179b3d6d07e310de42f6
TLSH
T1B2A0021113C10185D41A1DF51B56038B5356EC1E13401307D193545AFC548544D6120C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a60c89dd-a9bd-433f-9c23-29d773ebf173\index-dir\the-real-index
Size 360B
SHA256 4615939a7e882595268d3276b993af9ca5e6b63809a692c6a556871b544dd779
MD5 3015fd93d7922d1ef07c843a4d11f427
SHA1 4f599c0c62f430c2aee085c38f92aa136a126c37
SHA512 a38c81df3c8a671dde66466bc59f7de9db7fc79e89e8ec58f504c94642b28999f862495cc8ddd5e1ade3a0c1a6532340f30d712d2bfbe1f764af61868b7339cb
TLSH
T13AE02B981D235146FC594075647DA171573124FC5324160F74FDA45A8C4B388BE57728
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a60c89dd-a9bd-433f-9c23-29d773ebf173\index-dir\the-real-index
Size 3KB
SHA256 36dfe5db37d03b9383f19cbdbb50b3ccd4a5681129986421d7706589420884bb
MD5 02c82126ad4564decc8ee9cac25c2b49
SHA1 f7353a01f7bcf79b74c9910b66676bcdce8a5516
SHA512 c55f12e20209e1afe3ade18dcf03f99cf3872ddd8eb428ce383a08e14ad2862a82976d646b7249322799a8d24c1ef4706aadfe3cdaa033b704abd7de10210523
TLSH
T19251B54F8D435BA9DDA8627115B60846377835DD2394092B65FE9239FCC373A298C268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589bed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a60c89dd-a9bd-433f-9c23-29d773ebf173\index-dir\the-real-index~RFe589bed.TMP
Size 360B
SHA256 9d03cf2ca6876ecc86133cd70bb629c378c12e064a3d78396543becf4e0f4196
MD5 47c3d66ff992cfd0885590668378c214
SHA1 5eacd96ff9a4aef69f36cd280aa556b68975d247
SHA512 68e7316d86ec3ef46b36d4c8f012780be9f9be02b558c28c780de2b1b0b1f360ccd772dfe371ffb5af1d728ec63510a149ad5aa65a80aaa2a16cdc8f3934eaf1
TLSH
T129E0955906139185F81C00317C7E61317271245CE370270F71EF8059DC83B845E02F24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 194b69a254f7a79f2dd74a251a2b43a7e0b410a00bbdf451fef581d5c2df6371
MD5 48389814edbec5522828859bad24db3f
SHA1 3cc94415bb19642ada77c76447700d58b1014b94
SHA512 4b8ff9874066d3b8851cce37f13fafed9e9c56a66d69a7536977afaff30d5aacb1bf3a56f27c3005f53c583af8ff91548ecc87623078785d2585b151795f8063
TLSH
T148E068BB2DF21C30EC5B83E6343215D400027C58D84CAC8EA026A6871071219249AC33
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 922121242fae849fe01fd0d1d9f2d8a2dae1c8762b46790f547c664919a97f9d
MD5 b888a0d65bc1149f139a2ec5273f8cd1
SHA1 30cec638206e964dd7bede414e2d3b4de2e70c9b
SHA512 62cf2c4c7aefd13efd77456b878f1a10de88e49043524ea1c12d09733236252fc18e4925aa481c649041ec668d233ee19c7a82ad6021cbc8eb60492f3f7e1649
TLSH
T189B012104809D041C44106B194A6112831200C990205340140DCE3B85841180408351C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f23b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f23b.TMP
Size 48B
SHA256 f1a28764b2adb44ebbb47b7c7652c1a440dacb0c9782dd4fc219a90d0f0e157e
MD5 2e181af73b248147521b74d3c9dd934f
SHA1 52940b7ea2fac5479afac6ca50f7ad3705fea1b7
SHA512 5ecb0ee05638c2e7edc67e1d796539e221dc227135fc7d07e5e7e1ac53446322e93ff0aaf3f3507266ae0b9347c421f5dba13e46e7983fc1b6231fb942bde329
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e5845c111b43ba0116a6a30482203646f25c4a9ead436f5211eebdad5c095ea
MD5 1eab19d6fe55f700b1373b5a064c5420
SHA1 b9299f51260baeec3a523818c47f686d23a68b07
SHA512 2514b155395cd5512899a6c1095a1b05cdbd229c4200a32ea4445073e81dc98a6b09cbaa14dc0ae38865e01156ff4c3d0127074524e38f4068c65e9e18fe6c27
SSDEEP 48:K0HqTnpJZybRcBIS3yK931dyx3iYUFn7yL5IVpz3Lkb10JF3jXYbLuLISdYK991C:KU0wKBeiiZCoKP626qoKHqz
TLSH
T17DA1F21130B702813CBE299985B48B1A515335F33028E62BBFBE50D69D6FE051EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597267.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597267.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7aa6a8ac2213688d1edefd6b413009a92c6b398ee597bdcafa3b2ec54c7fd74d
MD5 63ed39a1474a221a1ce0a70d116b9e67
SHA1 f83246b873cf49994e1abb8f0b0b9cf8bab457ea
SHA512 34bb474fc613c126db1d8c6e0a89aa2db70d7c11efab829522c3e322f587b18ab46247c51a459f9f009b87e01430fb32e180c650fabe8221eaa694d11faf8121
SSDEEP 384:uZcIhsNRITBqo1bXV0Or2zIGmQ2msMYiOxuvzxV+MhdpUeUoB:Mhqo1RrAT2xJiO4184pUeUm
TLSH
T1A5827D31ACB8BCA6ADEBA545F8463A134EB8D13793C85F90D4EC9B1D00DE364130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a6a6a92d54b6e00248b19037194f9a5851bc296654fad614a5fc5d0aaef4994e
MD5 b0ec67f757589242edaeb7a298faa451
SHA1 08f9cd034dc52d443982f6b74adaa8693a0997a3
SHA512 7f046172cfcfb8384c1239f71268211cedc0355227da364bfd720571870a103fa863adcae5eb00c0ea54b951a360f9078b6414711fea0a3c4fea7d71de18d881
SSDEEP 384:TDiFqZcIZmsNj8TUNTUlIllTBqo1b1VFOr2zIGmQ2msM9DiOxuvzxV+MhdpUeUoB:qFI4Swg0o1grAT2xYDiO4184pUeUm
TLSH
T1E7C229F288E79876D9AE5747A73D2E134DBCC027B5849A50B3D85A0DCC9A2BFD306C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b292a7e881c839f5ef2afd91dde4fe90e23bf4780f79bf5e8d6c9052010012b2
MD5 bf07e7262e1254b0aa2c63c1c8c5af61
SHA1 54cefbe87cc99aca0d46e3280e141eb06448446e
SHA512 8d36ad24386462c4ed93bb3911d7d2526ed4be3e8f920a06e02c855463cf7dbb311f160abf3181cba3a8ada8e2c558e3480477fd99b8d4d96f430a5fb3df31c3
SSDEEP 192:aONe6IE7QmiUyXCXnTPuIGmQ2mdC7sv1U6:aONe6Dt2+TPuIGmQ2m+sdU6
TLSH
T15402D939AC787CA7DEE3AD48F4872A239EA5112BE6952F84D9D81B1D00DB25C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 51957eb4c78906abd1901c796a735e2a20ddcfe62b3ef2fa6bbaa987938d8489
MD5 7a0ce64e372e999c2e33f1c7ae5f3aab
SHA1 de3d8f731a6594b03de859eddd9e8cf7a5307f5a
SHA512 60dee1bf764735a11ff76e463a34cabea981a644315d1c274ef6fe762b74ba0fc64adf8af5446662b6a8788571be82e3651341d1b212ab8196ddda768c6a39ad
SSDEEP 384:TDiFPZcIZmsNY8TUNTUlIllTBqo1bvV2OuzIGmQ2msMLiOxuvzxV+MhdpUeUoB:qFH4rwg0o1f4T2xGiO4184pUeUm
TLSH
T1C8C219F248E79876D9AE9743A73D2E134DBCC067B5845A90B3D85A0DCC9A27FD30AC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3741664e70ea6bffa230ccb7be12e5b41fe3f5d534632326cb624bb0a07d8859
MD5 2b6bf9b927a220759fed6c2e3548da6e
SHA1 5ffaf189789cc8417ff99ae287b3e7bf92c863fd
SHA512 69bf286fc9a9945d1987a913331d7a580fc294ad53c613f23796799b0fd26392dfb5bd6bc8f5f0ac1a7ad9d102e4a7c0588a7aaabbdbb6618b90e3be3a52d5b1
SSDEEP 384:rOZcIgsNRlTBqo1b1VpOr2zIGmQ2msMYiOxuvzxV+MhdpUeUoB:Igto18rAT2xJiO4184pUeUm
TLSH
T141827E719CB8BCA6ADEBA545F8463A134EB8D13793C85F90D5EC9B1E00DE354130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3cdd73b5da9b857ad6f9dcf6adb65b9d8a6e6aecf41d57b5ea41d7e769101f43
MD5 139dc2fdba1c05a56479cd0da0d47354
SHA1 136e92891da86ea031dde10a6ad235b708146338
SHA512 50c64b3bd15f3efa0f429bea81e53a2e999668d019506175ceb4c1293d8dd26182a616a2027285a6bea7a8d31548ed5d2c61d075933295bea5c2508946bd8f19
SSDEEP 192:aONU6IEyQmiUyXvXnT2uIGmQ2msMp27He/N7U6:aONU6Du2vT2uIGmQ2msM2HOU6
TLSH
T16612E8369CB8B8679ED3A954F4433A239DA58227E7C97B90D5DC1B1D00EF25C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

580b0ccd-e807-4751-bbd7-b955518bba00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\580b0ccd-e807-4751-bbd7-b955518bba00.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 23460a88961cedb8ec035afb44b71a87e7c2e2fa4216612af6ab63653cb1018f
MD5 c4ce16d1dd30ac75ccbb94cf92ad911f
SHA1 f9017312cc63fcfdd7bbdd1b8bd5b38ad3ae418d
SHA512 07d58a4a70963fc5ec0e9286e5aa162702e4e7eff794974c70a204dd8aae51e1e970a332785c402ffcb9b44c8194e8ca218da048fdffe20301ebbb299b7c8129
TLSH
T14E412A58A6F91148B3B76E5AAFF6A46D487BB9372F06945D10100E4F0A23A44C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

cs2shop.exe

Path C:\Users\Admin\Downloads\cs2shop.exe
Size 3.0MB
SHA256 53e672b229ce76e7e764935a469b92a8ea79a998ddc2f2d7ebc86a00cc54ceac
MD5 d190c348ee95d61b2b3fb95036214480
SHA1 20fa146fe88d81abbb80c00771556838e9541b36
SHA512 ce5aa17038786c44a231aeb5e3b7f9a80ea83fb1725344df974ed78eb1fe92299c7c5fc62e73375f60010bac2b597e4809935fa3375228a35955f2470abfa825
SSDEEP 49152:BObxYjG4nFLnNpGvvCvjEFFqwSAau4cRzOiJWAZArPhhHsCES5urZea9D5:UtGYvCQFFqwSAp0oMMbcU5
TLSH
T111E57D026DAD4424F2216F77F99F8F6B9E74EA44291010CBBB8C73859D327749E232D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download