hxxps://github[.]com/IMXNOOBX/cs2-external-esp/releases/download/release-17/release[.]zip

Analysis

user interaction
yes
max time kernel
182s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/IMXNOOBX/cs2-external-esp/releases/download/release-17/release.zip
Sample261014-tp6ftaxyhy

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
197	camo.githubusercontent.com
198	camo.githubusercontent.com
212	camo.githubusercontent.com
213	camo.githubusercontent.com
217	raw.githubusercontent.com
218	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4016	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{F0F63BE5-83E2-4904-BCBA-191DC99B1293}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3592	NOTEPAD.EXE
5588	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 5088	904	msedge.exe	86
PID 904 wrote to memory of 4016	904	msedge.exe	87
PID 904 wrote to memory of 3476	904	msedge.exe	88
PID 904 wrote to memory of 3476	904	msedge.exe	88
PID 904 wrote to memory of 3476	904	msedge.exe	88
PID 904 wrote to memory of 5432	904	msedge.exe	89
PID 904 wrote to memory of 5432	904	msedge.exe	89
PID 904 wrote to memory of 3868	904	msedge.exe	90
PID 904 wrote to memory of 3868	904	msedge.exe	90
PID 904 wrote to memory of 3868	904	msedge.exe	90
PID 904 wrote to memory of 1208	904	msedge.exe	91
PID 904 wrote to memory of 1208	904	msedge.exe	91
PID 904 wrote to memory of 1208	904	msedge.exe	91
PID 904 wrote to memory of 4196	904	msedge.exe	95
PID 904 wrote to memory of 4564	904	msedge.exe	96
PID 904 wrote to memory of 4196	904	msedge.exe	95
PID 904 wrote to memory of 4564	904	msedge.exe	96
PID 904 wrote to memory of 4352	904	msedge.exe	97
PID 904 wrote to memory of 4352	904	msedge.exe	97
PID 904 wrote to memory of 4352	904	msedge.exe	97
PID 904 wrote to memory of 4344	904	msedge.exe	98
PID 904 wrote to memory of 4344	904	msedge.exe	98
PID 904 wrote to memory of 4648	904	msedge.exe	99
PID 904 wrote to memory of 6048	904	msedge.exe	101
PID 904 wrote to memory of 2100	904	msedge.exe	115
PID 904 wrote to memory of 2124	904	msedge.exe	116
PID 904 wrote to memory of 4824	904	msedge.exe	117
PID 904 wrote to memory of 6088	904	msedge.exe	127
PID 904 wrote to memory of 6088	904	msedge.exe	127
PID 904 wrote to memory of 2680	904	msedge.exe	128
PID 904 wrote to memory of 2680	904	msedge.exe	128
PID 904 wrote to memory of 2680	904	msedge.exe	128
PID 904 wrote to memory of 4536	904	msedge.exe	130
PID 904 wrote to memory of 4536	904	msedge.exe	130
PID 904 wrote to memory of 5436	904	msedge.exe	133
PID 904 wrote to memory of 5436	904	msedge.exe	133
PID 904 wrote to memory of 5436	904	msedge.exe	133
PID 904 wrote to memory of 2628	904	msedge.exe	134
PID 904 wrote to memory of 2628	904	msedge.exe	134
PID 904 wrote to memory of 2628	904	msedge.exe	134
PID 904 wrote to memory of 316	904	msedge.exe	136
PID 904 wrote to memory of 316	904	msedge.exe	136
PID 904 wrote to memory of 316	904	msedge.exe	136
PID 904 wrote to memory of 5848	904	msedge.exe	137
PID 904 wrote to memory of 5848	904	msedge.exe	137
PID 904 wrote to memory of 5848	904	msedge.exe	137
PID 904 wrote to memory of 3520	904	msedge.exe	138
PID 904 wrote to memory of 5164	904	msedge.exe	139
PID 904 wrote to memory of 5164	904	msedge.exe	139
PID 904 wrote to memory of 5164	904	msedge.exe	139
PID 904 wrote to memory of 4560	904	msedge.exe	140
PID 904 wrote to memory of 1764	904	msedge.exe	158
PID 904 wrote to memory of 1764	904	msedge.exe	158

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/IMXNOOBX/cs2-external-esp/releases/download/release-17/release.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcf6c9c188,0x7ffcf6c9c194,0x7ffcf6c9c1a0
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8427382363091137015,17673511797994335177,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,11640281903975197331,8530178696957714938,262144 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,17242101534960943674,6249377390498056771,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,17825646665548466415,2244579837686109296,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,17521168825997153528,15371269353094190658,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,11530359078943798473,18250740925355236013,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,8261646103070613426,8676934233910347522,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5580,i,8922262226831369516,11331938941826175620,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,9566114936172418128,2217157696236003083,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,11195827351344962321,4557712279974955697,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,8619085462721245710,13137454329049779203,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,8619085462721245710,13137454329049779203,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,13368768402976611892,7202759108940083988,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,9780428279194656191,17090785214045547552,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,12485272428307814612,3565203318477128503,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3068,i,13144174156872959985,16396048367011504201,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3516,i,9198568737419893827,2296048608695133569,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,4248106353404417602,17048555149229181387,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7008,i,3489689402829082238,323232199962487272,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6936,i,13057988332314515512,12282267128836670140,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7148,i,9496386743792441192,6793882477808592643,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7164,i,469338512374529366,10229869581496923026,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7452,i,14168579774265509447,10760264956986697366,262144 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7536,i,7930751436085725154,11185743263410788717,2097152 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,7981363146650599620,17329949282659643541,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,701413499792696788,1748598290164880058,524288 --field-trial-handle=2316,i,6689340201180284039,4474288711177890378,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
  2⤵
  PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4856

C:\Users\Admin\Downloads\release\cs2-external-esp.exe
"C:\Users\Admin\Downloads\release\cs2-external-esp.exe"
1⤵
PID:2536

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\release\crashlog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3592

C:\Users\Admin\Downloads\release\cs2-external-esp.exe
"C:\Users\Admin\Downloads\release\cs2-external-esp.exe"
1⤵
PID:920

C:\Users\Admin\Downloads\release\cs2-external-esp.exe
"C:\Users\Admin\Downloads\release\cs2-external-esp.exe"
1⤵
PID:4292

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\release\crashlog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16c5de79-599a-4251-a159-61250e1d46a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16c5de79-599a-4251-a159-61250e1d46a9.tmp
Size 392B
SHA256 6a7aa8dc5a463282bd0b3f0d89703c5f76ca4a8a3d5094e980caafb41bebf958
MD5 42b7c897b5dab4ddd4090ba49de8f40d
SHA1 1474546f555a714968351138862c8bc641ea5f80
SHA512 1710cf9aef8635a25c27f97d9282e6bf51943c852aa00d64314dcf4da3af175c554acdd478bb13cbe00d6406151289cad2a9db25169e9d2cf5a17a91163f938a
TLSH
T184E00203634102FBD02C037000832F2029F3C43003F302451E3415789D223002E31F54
MD5 SHA1 SHA512 TLSH

Submit Download

317f763a-f16d-4f22-9b0c-26513dbd560e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\317f763a-f16d-4f22-9b0c-26513dbd560e.tmp
Size 26KB
SHA256 98b73c4994aab3cb8932c7bec4d2a82c51738960ef897b59b4aa005626129ed8
MD5 2a97b8a7278ecf7bd35defd92ec2ccff
SHA1 8f69d8a607a4312364bc3c3479cdfeeb702875b2
SHA512 a3f6d739da536d8477d6510be0415fd9fb5752f131d90bb1d4332e2577c4ce34b707494a239b883ae9ed35dc4f4e4d82614fea3d28c8d31fd29707e6248715f7
SSDEEP 384:nZiFzQkUSvZsNA8TUNTUlI4P5mgueWWe4zf8B7neqJjPJAxJggL/7IzcIIlj:wFdZhwgj4oBZ5PkJ3Ld
TLSH
T1DFC25B36E8A4DEBBADE74A91E34A3A43EEE05263C9DC4AD4DAC95D5C00C71DD130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43eae6a1-5857-4152-9bb7-67891139fef9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\43eae6a1-5857-4152-9bb7-67891139fef9.tmp
Size 26KB
SHA256 63c56f669598bc6054baaf6439888c60aaddd08ed680dbadcf666aaaad8aea8f
MD5 84d3bf84177d8b0c8e0a7460c2897e42
SHA1 556f1c98044d32d4c7cb9646b8585ec6fdbbadb4
SHA512 bba0d250ad2f7c160e9e16a7dd6bd7e81e2c2c0408b700d25c8dbae08d5483714966af94c3e7e87c2cfd6a92ce48a1531525a213ba3350804d44627ace5dc2f5
SSDEEP 384:ntiFiZcI63sNk8TUNTUlIm25mgjnTv4zf8B7neYJjsa+VY/ZgL/7IzWcoO:kFQ63xwgSshBz5hga5
TLSH
T1CBC23A72E894D9BBECE78BD6A78A7A03DEF0426385DC9AC4D9D85D5D00C719D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fdefa07-8df6-4b74-86f7-cb039969a526.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8fdefa07-8df6-4b74-86f7-cb039969a526.tmp
Size 27KB
SHA256 1c05e358cfc10120fbce9c57576d9eea68341e39d706497ba590766aedb0a131
MD5 ac82eb7e4786f2200a2630253d4ab06e
SHA1 9d2ae564028cb656d5effd327591a217b3e0303f
SHA512 df2d4b4792ddf5268dcc974f67c2c3341ec6784e8b7a3dff371ff25b8e48640ff751c6a84b870889fb86c6a92dbd774931bef3f002eb717f9c19ace651cd77dc
SSDEEP 384:ndiFoQkUSv/tsNiy8TUNTUlI4rTJmguXBWOS4zf8B7neOJjPJAxJggL/7IzcIIlj:UFglTywgl3f0BJ5PkJ3Ld
TLSH
T1D3C24B76E894DEBBEDE74A91A34A3A43EEE05263DACC4AD4DAC95D1C00C71DD130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

13ef73d0-b7da-44e5-8830-b064d225410b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13ef73d0-b7da-44e5-8830-b064d225410b.tmp
Size 11KB
SHA256 2016b13f7dae68c301399e7cfe7c6e72772d5bba3009d948c56f1c5beb815e56
MD5 3b6eca8e99eeae2626b278c4bcebe36b
SHA1 90a7eaa779d81b379316093278f679d237078ac4
SHA512 cafa510ac81b866d10665893cd92fbf556c1f1922e894a69983e975afb895971a579eeabd82b9892b0437c7f90c45819db3a4e4748546d91b2083014c86394ce
SSDEEP 192:sxZtARH9L/ftsPQZZeYzodpLHW6+WNGYbIUpnYA+Ig5cpJ:sxZtA7L/ftsPOZerLHbGFgYHmT
TLSH
T15742C755AE28A93B9CC7D209FA557F53E7F96032A0941E44A6FC8A1C05E7ACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21514479-c36a-49b8-8e25-500a2a017801.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21514479-c36a-49b8-8e25-500a2a017801.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

47c4770c-3dc9-472e-9f5c-1981af986ef3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47c4770c-3dc9-472e-9f5c-1981af986ef3.tmp
Size 11KB
SHA256 cd95e7ef33ef28fa9180dc8334938224c8daa23b19c90710e3bd447a85144197
MD5 3f75d841fa8057594e53544fd2e80c47
SHA1 32975d3c885b4d4e8d66332638c1e795f10ed258
SHA512 e5f575898b3a76a65ebf2f628786968ca4a00aa2062e240cef789410f99f329fef1c74470230e9f73b0bbd0537a1caaf45ae20c583558b325c750b43ce5143ba
SSDEEP 192:sxZtARH9L/fts3QZZeYzodpLHW6+WNGYbIZpnYA+IgjpJ:sxZtA7L/fts3OZerLHbGFfYHjT
TLSH
T11642C615AE28A93B9CC7D209FA557F53E7F95032A0941E48A6FC8A1C15E7ACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ff3f062-ac7f-4e4d-8d79-4b6857642491.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ff3f062-ac7f-4e4d-8d79-4b6857642491.tmp
Size 21KB
SHA256 6081d793982ce0e7075d4c4ec14968526d7e87ea5e41ee67a9e3ed7addf821e7
MD5 0848640983a280a9f3b7f7fcb1675b81
SHA1 b2c11d43eeb6ad87be93a95fb3c832acf34794aa
SHA512 aa8867220968aaaaf7e3f017718d9dd3bf4ff15810c3d705c08dd12e4de475fb9940509dadcbb500f692e26851c435ea8e4ff1c75d8c108df96064ce10b7993d
SSDEEP 384:sxZtfn76mWL/ftsPOZ3faHPYrsHbewXJGYHmdSF31ISFc:sJ76mWL/fgMfaHbHJGBU32Uc
TLSH
T1B0A2C752A920C977CCC7D519AE35BF51D7F915239C924E8CAAECC92C04DE2FD260782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7858754d-e4ee-4aa9-8b4a-363eeebfc95d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7858754d-e4ee-4aa9-8b4a-363eeebfc95d.tmp
Size 20KB
SHA256 61e3f01168592b5443d9b01a9689d1907e0c4e6ec8bd820573d088f96a99c705
MD5 eb07140b8b054e5addad0116a0cf193a
SHA1 72831a32619183aa654ffe8881d723f522d210ae
SHA512 55bb8978e99b373301410451c100e7cf1931157cb3d347c7389fcc8ec9ea6cb2bd4374937b7457efa9bffc79ca412747b3d094d19dd0c5c6aae0619415bc82f3
SSDEEP 384:sxZtfnf6mWL/ftsPOZyfaHPYrzHbe0/J/YHmdSF31ISFc:sJf6mWL/fgdftHbdJ/BU32Uc
TLSH
T12EA2E8529A20C977CCC7C519AE35BF51D7F914239C924E8C9AECC92C04DE2FD260782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c81ae33-2f08-448d-8039-414ce83f0aba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c81ae33-2f08-448d-8039-414ce83f0aba.tmp
Size 13KB
SHA256 5fd217c0d9dc6fa2a41baa1661e7fde94ae21aff1cf3c2d9f58a7db401ccde4c
MD5 3834a21cd86490ad459a6cb8a9bc6a35
SHA1 aa9844be665ff608840a2206205e65b363b29c48
SHA512 f88d504e826b48045b8f768d30006e5ddaad959457cbc43602304bfa43e255e73b9fe6a8b4a6b25350496bd39c1b3670b44eff610d28105a919d851ad09258d5
SSDEEP 192:sxZtlRHWPL/ftsPQZZxfKbsWHP4odp4lHW6+WNBxt/YbIppCYA+Ig5cpJ:sxZtlQPL/ftsPOZxfsHP9kHbh/FqYHmT
TLSH
T15852D815AD246A3F9CC7D219FA55BF53E7F92133A0945E48A6FC8A1C04EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

939922af-b0a8-4a16-8dd4-7fe749198ad9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\939922af-b0a8-4a16-8dd4-7fe749198ad9.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d986263-51a0-4294-a343-68e6a0c30c91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d986263-51a0-4294-a343-68e6a0c30c91.tmp
Size 17KB
SHA256 0f0b04ddcf5140e30edf386a7fae8c04189f8362f38572b0ab7691fdec863dab
MD5 783cff81a02d4519ba5f6dc767805a89
SHA1 df3d99127b36c5811615859b1b071e6575e931f5
SHA512 1a5df7898a8a43f84e0e46455daab036d946ee4fce25c61467d8b2b0de5208ee67775761a8af672fe437848647506e89316d67cc01588d84267d719d11ef540f
SSDEEP 384:sxZtfn0QPL/ftsPOZxfaHPYbkHbh/FqYHmdSF7:sJ0iL/fg2fWHbVFqBU7
TLSH
T1A372F812AA20D97BDCC7D519AE357F52D7F91023AC954E4CA6FCC91C04EA6ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9f281416ffbb0091a2857536de687187aa02f0a866e21c9afdcb859a83b1ee53
MD5 8768cec5e0a8b3f0f3ed757abdb0630b
SHA1 c14b0e4de55f18e521a4b4dbb16a0e5eb1eeb555
SHA512 c73dcaac394163f54b8a4dfb9fa22adacded7ce65a93759b824bafc81e048a85a23fddf794ee46c38f5193b002150bb5e85ac3655b5e80ccec967ff4697553f9
TLSH
T1AEE0269509C9C27EA34E658701BC534CC3812B9E92D8EA2E2B00DA88700A640B382A91
MD5 SHA1 SHA512 TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 419KB
SHA256 b98d39520feac7cdc2abc31f51e0278022dc26cbca561504fcda184313b9add4
MD5 5c3d9061be366388563b2874928dd525
SHA1 4390b61d9d9cc13fd4c294d63481299a4e42bed9
SHA512 f59402b6fddf69e4784e0e2c95375e643b2fc2e86387a11117ea3c15f45928b6aeaaf7b8d7b5bbf889baae8b90b18e5d80711c831476cff12cc4405a43e6f5e9
SSDEEP 12288:1J5BaJ4RJ/6+QLm7Ulu//LCN0W+J2XKK0:1J5BO4dilu/YVg
TLSH
T14F9423590883ACFC04D21E97BBB49011F162BFBD228A7E676D19F219D7054C723E7E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 70KB
SHA256 1101c11b4e403b787f9ffb3afcc94a9fe288ce55fa5ed8e482d22f4937df4ed0
MD5 b9f81ac5471b045c9b639cbb3a4df350
SHA1 eae7f58076145b73341ed6c8d47113c51ac574dc
SHA512 51208e8882cf9e57a8a987a7b3776422bf82263e1e7356a422321bbabd655dbd94fbbd747bcf51b87b05644cd4ee50d0cd55f1304d02ec46bdcf2be6e45ac610
SSDEEP 1536:zZUkTnSGAzTLWeCaAh1+LzWEQIPJu+z8WALwcurljYhIAmC:zLhyOhIHWcJ1otwGIq
TLSH
T12663126F709A3CC68D312F4029BE8C31A59DAC4CD5CD41AD392B45AE33D66C76C9CA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 206KB
SHA256 a3c435c6e44b2d06a91c766af06aeefb4164e5390d3fbc24689fe7a328216a32
MD5 422cebc5f1cfe561090835ab4f3c9e74
SHA1 299af78fd878a4132d2ff0082155e0c4a8b5964c
SHA512 619466c5d3af4d6a0adcdaaac900aed82b2391bd99c1281d99c7942ac98a7b8dfb68070fa763b1b3e7618924e1a69089b461fbacd28fd5b72f15abf42f1b83e4
SSDEEP 6144:/isRitOP3ItRBlVBfoS/Pa0gSmb6fEExF1qFGd:/iiic/IX/gGPpmb9EJn
TLSH
T1A22412942BE789245E7BE2D65A8F44579C2C0E37C8B48F3F2898035EE9C94270BF46D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 27KB
SHA256 d8f492a3b2b440f99b99ca20aa208419a2ff3434fa08992e7a5ccd4f90fe09f7
MD5 8b2b699d8117447930c6ec35be5ce1bf
SHA1 4755bb0de47453d0c7c9d3554c0817fe43b16faa
SHA512 0ec74a140efea57cfe62e43b184deb3367c941e338a1394a4fc2483ec391e52e9caaf43200c3a970660cdf74a5692a7a083ac79675397fe4cb90b585e3b1964d
SSDEEP 768:tOtXHHGSKIj3A/HUtFb6ofBs0ltoijHHkJtmZx5WOCL:8Br7A/gFb2smijHymn5W
TLSH
T1D8D2D16FBDE86F44943C5960790232E1419E9A70B384AF372175B2B175378AE6783CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 78KB
SHA256 bef3accdb9f149c51a69c5cabb2339bbb9ac6ad6b77acca6f4513d631c2db254
MD5 eb489b49d395b84735a04e77a78d08f6
SHA1 254361de725f83a65c80cece4b54d3bfa2ad3f56
SHA512 8c9ae67f058b043488420c7d09cc545ccc7e514f5144ab6ce04d9d7dd18c998cef6f5969d2ae7daafb4e89074b8a4e4f7ba99598eee335b2c7ff461c57e3c380
SSDEEP 1536:EEYbLgIX818dEQYB8YKyUuQxvBdBGd0uNiV1PorTSD4LX+qUOPk7Z56AL2K5:EEYb0IsmEQYB8ZyU1vPVuNS5ofK4L+TL
TLSH
T1E373024B80ACD55F444ABE1667DB90F80F4FB2F91428A7C46D32AD3A21F51DA5BC23C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 59KB
SHA256 484fed28305e8a1256870a26f905be957ee23b5c5dc9c0daa5b01435e7de3408
MD5 4a71d19f1524347cefdace1552ca0ce8
SHA1 88807a5961fcea0ac750386a58fe15cd2bcac4dc
SHA512 56265d2a570ce38ce785c4465efc3f93013dfbf663cfe379647c3447d8da4d640634333d13d8655286591766d53ec04ffed8c9bbbed0c0275e303aa4e6f2cf08
SSDEEP 1536:I7NouaEbzqNcgQMXR/ZSnTn4M1U6nnZ1Sop:IR3aEbzq6eRBkn3Z1H
TLSH
T15A5302E98EDBC7BE8506083278A11D875DCE4685B53EEC1D9058223F53D4CBAB7E825C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 72KB
SHA256 fcfaf2e8e1a5d8cff6e2c7736a10a6a3faf27d4696d5d4bf1e2d34cf3512b5e0
MD5 e23f701a0478bb09e5547db5f18b17de
SHA1 cdff049aee29553f0533f7d692d37fae129b7a6f
SHA512 370329619cd303f5ce5bf42692bed1ef7f8c04f4a26181ad42269ac5f6b81fd1ca87034a629b969cffaaa46a626f1eb60fb70e71dabb9f11148b5cd038bb6959
SSDEEP 1536:SVJ0GggPe5RTRIY+6gr24bw02G3LkxUsljvsEQ+:825wY2K4bw03Lhs2y
TLSH
T1CA7312B9871A01B55393D610C935859E3AAD5E1EDF02F85B3FB969A8B08F1B1CCC0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 20KB
SHA256 5d0ec13c19161f8803c3549a92cc18ee1d00ab3fc84aa56059de03f3d166ac9a
MD5 305e98e70a5d17126c174904c054b517
SHA1 dd1260a68abd22b0b3c2ad0648a99e33ab95c073
SHA512 46900f2e8eeb6a9f95f46f13f7d455b2878fcec0863db3af9124878ac7aea3ae9c520f2ce5613623ffe877e1794d06451ec850f9143ac438f162a836e2eaad02
SSDEEP 384:Oke701wSRYsV3nTenhdpny21u0b+mZtRlGUog2bH++I7UZG/4+L3dE3HFKA:O3701wYYOXTYLpnyklfZtRMUz+kU+4im
TLSH
T13A92E11D5637BBA5C406C568C2FD5A4201F2AA00ED35DBBFAF44A206F9F0DB720462E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 512KB
SHA256 3524d8883e4d5781b6215c05f97d1232b442cd41f66cc59723de6c5e19399ba3
MD5 a0355e6554046083e262e04dd1ee6199
SHA1 73f053d90ec3e9ddf235f2f79902350096be795f
SHA512 3e794941897c103033e709913af6e7057295c2e9f4587f19d1a13bcc867c86f6816d168245660195ea96ac17c833696abad4a4f034aa9dc2a45033ca09d52a11
SSDEEP 6144:aVIHGR+Y4LbXL9wD4GR9R9YsRUhovbfxGyTmSfKcKApMqdjdLi9NrMCrx4F:JU+YI9wD4GVwdVALzu9NQCo
TLSH
T1B2B423E9E1268529D30484B1BD769D0939BA3B681DEF3D4B04009A62FBEF1D0761EFD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 16KB
SHA256 8463ed535eccb85e24c0d668a6055b3148777528304e8c9f8d510be0628c0467
MD5 70174baa8df618959b52d33daffcf977
SHA1 0231d481756e7ab0f2981cce9188f5264ca52c24
SHA512 6868981093a1a62be90e19d61ea7707a1339e948e8c9bf39f9f32099f30087645cdd373f51538250db85c224f3a9722968828e1efbf1dec9c240cb41f9309f12
SSDEEP 384:wj/7tiSG1hvqvic6UGgrauZoMYVT0BxzEFz5Sdf2/fIGvUP:wN+qvRxrauUVTsESdf2/AGu
TLSH
T12272D07FCD04DC51F328950E8D442896C8409CBEED9B7FA73A6D1B7AC8083D7C28568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 39KB
SHA256 07778ae031b667f438af8f228d4adb14142bf4dc671ebc844366f3120653a11a
MD5 20336ef40941e8b61988bbc236b30cb6
SHA1 356c17e582adef868cabe794507bc155e01f9e09
SHA512 9b5318d9195e69cf3b25d0f0aeee4a3d68d1f1a6cb738cd5b69a084d84be3533d82d1dc6328c27e682c760e3996cf5584927c7db7b8ed912c27ac2d5f97fc932
SSDEEP 768:MCX7DFrKg/QfOuRfj3ENiWAuVxi+ZN/q6Ok1szl/6vCt1:pr5GZOmDENiWAuV0+KZQ2J1
TLSH
T18603F1887CF05D9E84933D3D9AFB896E3146D7CA0698BF6283FE5C42818D8F00D35A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 84KB
SHA256 50bcfd10ae420c10ef7001eabf7992ec5a4583c855867d32f76b6aa4d70abd55
MD5 ace858edeb3d9b101f85c60618e9a725
SHA1 c2c48e80d59d92e6b51f19afa927ab50f0daac31
SHA512 4f4701b1bc649e530b15a7b62e4cc98ea2b49c5ee119af57ba19d4e3cad6a26dd7101589e7184b9e4de0d974bb8e74fead64d5480fe7d6206c14d3731044fd9e
SSDEEP 1536:ZCk0CMxnHaKpgxTGW1jOgJOttaxGOkxZCkWeO6muzGpzzEAD1OFRIHoJ:svCMxHbgxTGMj5nnQHWXRpzzEw1OrsoJ
TLSH
T1358312D41F78F3D49713CFA7EB76825560308CB8CB9E9E4286D166AC0B5D018C968BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 16KB
SHA256 d237f87d6adc74cdea6630d818ee82137d7fc99d93571df1858d296d42a2cfcb
MD5 13f06c0e7dc2508d27f6c50b9e407014
SHA1 5ebf4bb90311a83ace7bd4ce64f95f2b7004f144
SHA512 67d199bbeb1efc68eba1147970222c555f288ac42202edde1a197492039f8142311faf79713a60c1eacee3a36c1c4a44211f4f4b13d22b3ee19da04b062c6ac3
SSDEEP 384:NSjtBb8riTj//HiT1J4CqDmyljHaRIyfffEn+N4Dm:Eb8riTj//ueCqD1Ljyffs+N4Dm
TLSH
T11D72BFDBFD1B4F280BD24DDABDE152B44177BE994B8990426920C5E0BE023A55F1C3E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 22KB
SHA256 631feceeb62f6bffac0c441856e9a1fac0077f22b7f5d0d59f815101f907e6d6
MD5 657fa7e347a86da16ae610fbe743cd20
SHA1 14e116f231ef4f4dfa0508963845ac8c6e2c465b
SHA512 8e09e525e1c6ae6f894dfec9f05c9b0d2b297e9d1edc33c11c449693a11a4f188f13f7b5612659e8d954172b0d1a0741f836cf659f001d363cc743ec814aa811
SSDEEP 384:+RZoPnEpmcJsD3ZdIGwHrj/X70xdi90D88c58nSdPnBUpB3x2XvviE:+RZ4EpmcwveHrj/XIxdP5SdPWdx2SE
TLSH
T12FA2E1FAD2A155E4F48212EF738D513AE5020A7C445AB69AB758F5FBFEC0138D4F9180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 45KB
SHA256 940e937d624dff1d92f851eb934d25d8f553b21ece4ea0cd28ce09a9c26d42a3
MD5 44e017eb03ad119606b480cec663fa30
SHA1 9241911887c38c5465f7c2e52241aa36cef8fe71
SHA512 fa9327022c36d67b6a43370f035d1e7817e65e0a8260a14084dff52665372fafa909c2b1e41e7590aca67086c84f975093ceeb0c2169afad18f7dd066ea3bbe8
SSDEEP 768:n5tNF8slLi+NBxYf86HMA0PF8/3SDtPoHMzqQqZKq1r/sFD5f0tjlLILDkF1OYh0:5tNHxNBx286HaGfSDtPo0q5rwDetRwDH
TLSH
T17523F10BD1C595933AE03B3E3ECE143C80846699A757B2E2F12A350AC6E4F59C50F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 4.3MB
SHA256 9ee760e75217aad05d9eff332a6ef4e3b325a1581a76ec06fa830f7fe91ac7d4
MD5 2ca6b9ea3b125c3f78d265be03052fb4
SHA1 337538e8b1ec4c652916201401a837e578f7ee36
SHA512 2f1e326a0d660960111aa846bacc9dcc195f06fade9a04e169a089a2a2b3cc9ee8a8b89a739e706d213c670f3f47c3bef824e5ec696229a0966cb6ce18091c8d
SSDEEP 98304:uVhSTbAYFbPdOCtwH0kbSv5aqRCAgegeVklmr2+SDhnyO8I5Ec:PjOCuUkOB17gxzmr/S1yq9
TLSH
T173263349393BC5622C2F5A31F5221D324A77A0B7BBFE1567E87B1839C661CF012529BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 10KB
SHA256 7eb2683c0755494aa35b8e1551ec3d4fda0566c04082918ba6ba1a7ba8f2e909
MD5 8e95908dec6f3b7eecbfae7fca677d35
SHA1 8a588f076b88766b59c57765e04b65e6f84477f9
SHA512 5ab5a1ffa5c83320cd8905b0623765f42dd604f6b5e5ed3aa60d8e219dce0d6ccced7e39796c5797cfc7c89b9376e4873588b4e83ba96cfcbc97dd4cfb2069db
SSDEEP 192:G60QdIOOgAt7TT+iBJN7bFqgjRc75gA/ru0O7a:GUdItnzvBJdsvK77a
TLSH
T1B32295929E84A27EFF7478B70ED02E8537BA509B51033F96A0DABA37E5527B55334C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb437491-94a5-44dd-9a99-594135d301ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cb437491-94a5-44dd-9a99-594135d301ed.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

16642e5d-1f1a-469b-bd84-184b71828eb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\16642e5d-1f1a-469b-bd84-184b71828eb9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

70d49fb3-869d-415b-931b-584da1db09b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\70d49fb3-869d-415b-931b-584da1db09b1.tmp
Size 211B
SHA256 46c313a213023b1fe6a95233f5d7576b52fdc82989ce468e0e5450f45d6f15b3
MD5 2dafc83c812820b75f73a3b06ff0569c
SHA1 117a4ff2f660a63fa44dd75d88aca42330381088
SHA512 7bd342672bb6cec9cb435509912238e557c0103a27ca9af43cd4eceaad97f56eae7eaaf7df65bb6aeabe03e2c1891132ddf91feb478d45f2c4d61ab32bc1662b
TLSH
T1B7D02357111470F5955F9D925175BC8FD37700542481DDD910D0546C493185C0747A81
MD5 SHA1 SHA512 TLSH

Submit Download

951ebb13-2dd4-4afb-b47e-d1d50837711e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\951ebb13-2dd4-4afb-b47e-d1d50837711e.tmp
Size 1KB
SHA256 fbfa86307f60bde69ab9a28f44c26b3c6578c079155733323aae630d2a8a5099
MD5 528cf92ee76cbb7e46e008b72665f129
SHA1 ce2720aec20825db458868cc4c5a9266aac0f7c9
SHA512 2c8c5faba8570c4e77ce5f7867ea27f04ccaabaa14300f1ac706548ed33613c731b705dd23aa1d33405731a7b96aaebd314eb0e6420933aa0789f93d946e0b51
TLSH
T15E31E4F787F4856E8A0196F0BA18AE1FCE2D0510931C7DAA84E4BE27D3E3471E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

c898c014-d416-46e1-a9ca-aff4cf03b3eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c898c014-d416-46e1-a9ca-aff4cf03b3eb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e38ad724-4f19-4528-b311-cf8b38187882.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e38ad724-4f19-4528-b311-cf8b38187882.tmp
Size 6KB
SHA256 77557f8510397276725d25450db4181163721c4678296fb220bd75076feabae5
MD5 7504ac599b0bd3712a9c11e86e7edf75
SHA1 bba5a688a0eedf1eb9e9821cec6511c6be5adc57
SHA512 552c10cefd1e88650f994e6b2cec96e0fb6c22ebe6d065930e813cdd46c2a0ac5ad239b9d1f2841687f4706f12c58c2d28e5db73a89bf85795d4c7fccab19432
SSDEEP 192:D1QOFnfZqmWaaw10kc57HfL/Gt1di7vm9mNGmgmzmtmLmu:D1QOFnfZqmWaaw10kc57HfL/Gt1di7v/
TLSH
T1B6D1BCF383E5826DDA1255F0AA18BF1BCF2C0455836C395A84E46E5BE3F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\abdec2f0-6ac9-445b-aa9a-fe965b695638\index-dir\temp-index
Size 3KB
SHA256 643cbe495970a2c6d4fcf9484c65c69392eb90f5c237d5f368f56c8a3c4770d2
MD5 d71e0e15008987b3853f45774e2857f3
SHA1 3391eaaeed8fb019d68293850de59a31da0e91f1
SHA512 dae671a38564a09eb9586707c376e38a1c9d8a1e900d69065f74a6d827690485c6a331837fbe7408ee4acd9dbfbcbb2d8e671a05de3f120a3e74d268bd7ba4f3
TLSH
T1CA51E71E8D061F52DC98537209F6048633B826CC6799AA1758FFC134F8C3A6E1C5A62B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b5f9bb78-b9e3-4188-ae26-64fd118f0cbc\index-dir\temp-index
Size 72B
SHA256 be302fba5f2cd6a2f67ce5831bf4b82c5b7abab3c038bae9b37ee1d3b0488596
MD5 00da12ee8b03d832b8b39eeb51f976c5
SHA1 2ce28d7ece2b0cee7d75dacb388ee22ac2457349
SHA512 0e79979b7bc42e9dc3c8fe07d1ffcc986c313483cfe0009945fbe269c073d9f4689e790b79ee17b5f07d10589d57449627a505cbaced2f6ddb11bd81da094747
TLSH
T14DA0025912887422C41353B0ADD6015E2318DC104301775B729442A9CC545529EC314E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b5f9bb78-b9e3-4188-ae26-64fd118f0cbc\index-dir\the-real-index
Size 72B
SHA256 db52af715901a7be39f4483eb50e881bd59946d276cec77cf607a172eb5f1b64
MD5 b894276e37e314e7beec4ca7f1d9dc2c
SHA1 72f8e607964bb44a6ed6d386598b583451863237
SHA512 1c91f18249b4de46ee80ae9a5cdedc4b5a5ae8e2676064053bceee7cd309d64dbf3e0f761b1cb10a3ede404da5a5b9fc22bdce9fdc0834eee4aac803ad701ffa
TLSH
T18FA0022047C4102DD81A5ABB155313912302C820B900170B40D94245CC918D44D4160F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 a60aaaf856088532ffbadff9a7f79d1f368f646e35032cf5215c2a481a8e6681
MD5 87ef3856fc37394022e0f208951405e2
SHA1 8ed6cb532af4842445c49ebc0b2249bc8eba77d6
SHA512 ed16ef36413f824cb0fc7d96a94d2c1069d42164c02e39181a0f1b7c23996e608a6d66c7cb5657aef03bb15e212744fd233c6724c074a99c3dde9bcae7f2ea18
TLSH
T13CE0D8FB1CB71860AC6A83DA257248A404863454C554AD4F3079A282A1E2365385AC61
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 656c0962ea6727001835838124d10f8579057e906e2ad8f8794ed58ea7eaffed
MD5 69c26aba0dc4c1e309f4e0829ad7fa22
SHA1 b68b66c7f24152e70b5ed6e801da333701d3c183
SHA512 d61f0a142808edaefbb8117b7771da841c87f97dbdfb5c696b26404533c5d9123489e397976b5b22243e9ddf92bf6e67f67f86370149ada110e3d8e97266202d
TLSH
T1FBA00258DA42E011D16602F4A17202E42210CF9C865F321390E8604BCD542668282459
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 b07b57d4dac9313182de12d732c9025facb9d4f1c2ba5355ca3cd63f2eccab13
MD5 8f6cfcf8915dd0993b245abd1127ce16
SHA1 471602f1bf1ab2c4d50acf017693ae06ca381ab6
SHA512 ab25cbcc28d4a9144d9de43a21a35fce64cbf800f4082cc46f8c9d3b4ad5d51515dd9a5ab513402d6e10d931fb755ea3d6fbf85bf021b28d486ebb883a4927aa
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 65d68c3d9dc72f3cb673e29266ebc390ed6677e9f0b2b571b673c7974a3bbe51
MD5 0363f679fd468383980d5aeead5ed6c0
SHA1 684ea6aae943a77fca9034e14642d69b35af7946
SHA512 d1540f2d671072048fedb80db937a89b1a4676dc5ab7b0cc2df47e29c94e39468dce34920b70449cfe5ed4d104d3d47b068ee5db6bfd699450608e5c5c2973c5
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXgHxjjg:OtfFvpopPxrB4RhfgRjc
TLSH
T12DB2401571BA121138FE390881B5872F064232B37258E63B7FBD54A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bc604f9e-24d2-4bdc-a2c3-5b1eb870dd51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc604f9e-24d2-4bdc-a2c3-5b1eb870dd51.tmp
Size 11KB
SHA256 5a98c99851798a8579f83ff3d8cf57eddcbe3ea1e769225096025a5646d29dd9
MD5 a2ef3def3192453dd04161654e18840f
SHA1 b9660f1b208f55382783152efc05474e2079af87
SHA512 0c09fa485280be7118ece9cca0ec8a75521f45bb69883becdeb04ffad2431dbce5594d51864ff9d5a75db9272a8e86bf96084db88ad3e4d188b297a9571265f3
SSDEEP 192:sxZtARH9L/ftsMQZZeYzodpLHW6+WNGYbIZpnYA+Ig5cpJ:sxZtA7L/ftsMOZerLHbGFfYHmT
TLSH
T18E42C715AE28A93F9CC7D20DFA557F53E7F96032A0941E44A6FC8A1C05E7ACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee35c595-7368-4eec-a95d-732221920100.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee35c595-7368-4eec-a95d-732221920100.tmp
Size 414B
SHA256 ebf96efcb091bd474bf9e9511541c4e4f1766553ea50062e64a65d665b55cfbf
MD5 3e14b66365117b8a0149fe64690599a8
SHA1 a00d01cc559820257a44db078991c34613c76a20
SHA512 4552ace0103317e7fe897a6d1ffc004fbf4a29c6e8fe59485bc6a5fa488d388ae80f59affbc351b25bc59002f0533f3443354ec531462005b71607520bc8ccad
TLSH
T177E02BE5CD19AC3B18FC471850940A81FB51134B2A80858F373D900D8FB1A37418696C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dfac33a862d4b4a840660d96dff1f60449194959e170cc05ed2d20c20b2f6138
MD5 a0d03375702df2fb17f61992e1685c82
SHA1 795f72977db0748280f9353d47fc680310f882b3
SHA512 e703512495ffe2a5122670cce72570a0c606fa286f007b1ed65c6645b4f6c0e7200707de44d529d75d58dc6bde345432d62cfada14af09c3c6537f3f898a6a15
SSDEEP 384:nUiFiZcI63sNZ8TUNTUlIm25mg5gn4zf8B7wTEsa+VY/ZgL/7IzWcoO:vFQ63MwgS3JBkIhga5
TLSH
T115C24A36DC98D9BBEDEB8FD6A74A7A03EEF01163859C5AC4DAD85D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ada51a40e3d04582383698aca4f7e61b10010191afd2e94c59020291a9266955
MD5 68c25a59ea39053a5ff464f44df85398
SHA1 50eb12a9bd959246631134cf5fa05c66db1dcb89
SHA512 0cbd116337bc280623e89eb70a35bfa0cdf9a77a78bbb03c8d920a4ac2738414c2a5a9325db87e8251ca13b248286b79269f8820b18887290c89fb4e8b43e9d4
MD5 SHA1 SHA512

Submit Download

b0211511-fdcd-4409-b706-36114aa1b6a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0211511-fdcd-4409-b706-36114aa1b6a6.tmp
Size 26KB
SHA256 5ddc06199adfe2d1f207285345bcf17f143e043ff6fdb045d0e03cb1a8035726
MD5 11691435fc74740f8609716128c76128
SHA1 59687cce482b88cca16411111655cb214d64037f
SHA512 fade0e6eb3ed7c0977384a413850b886d0036e41a0d346ba3e91f171f3ec5881ee0ddf010bd97ac77393c741c8d90c0fc2abd492d7499a3b46f6f541e4b3f0dc
SSDEEP 384:n/iFzQkUSvZsNA8TUNTUlI4P5mgueWWe4zf8B7neqJjPJAxJggL/7IzcIIlj:KFdZhwgj4oBZ5PkJ3Ld
TLSH
T173C25B36E8A4DEBBADE74A91E34A3A43EEE05263C9DC4AD4DAC95D5C00C71DD130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9d41377-6e1b-4a9d-845c-2dfff2708e54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c9d41377-6e1b-4a9d-845c-2dfff2708e54.tmp
Size 26KB
SHA256 f47f6300784f986adfb538b608c26a7281e25196662041d4d1575dfe2398ab8e
MD5 61110f20a1c801297ec0d6e777f8b46c
SHA1 8da5ea6c5c688f8877b85338b3a0fdab08af1788
SHA512 d91d93547fbccc2e5352a292db9e0cd0914426ebb7b92839f04cdba1d2cad4f8dd15844150ff0641276206be38b0f534adf3adf2bb628d8331996c4c5e3d5c0f
SSDEEP 384:ndiFzQkUSv/esNA8TUNTUlI4PTJmgueWE/24zf8B7neOJjPJAxJggL/7IzcIIlj:UFdGhwg1m/wBJ5PkJ3Ld
TLSH
T141C24B76E8A4DEBBEDE74A91A34A3A43EEE05263C9CC4AD4DAC95D5C00C71DD130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e579ca4c-9da6-44d5-92db-615f87be3953.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e579ca4c-9da6-44d5-92db-615f87be3953.tmp
Size 392B
SHA256 02f1c65cabe423e7983728f24a1c77a16e17d53e604760b35eca64a83bb47b5d
MD5 8ed6de6becf5b3d242de8131512c24b3
SHA1 28c588a3e48be8f6c2b952cea3485c2901532ca3
SHA512 8101d6ed06d1af998788bda945007f38786db1bc21de12d1b109e8b3a188d926cc7200600833aa216277a43f4293d06443cbca216c8ff4ecf3d333c5bdac41d5
MD5 SHA1 SHA512

Submit Download

ec9a2562-283c-4dc3-b6b7-9b17f077d35b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec9a2562-283c-4dc3-b6b7-9b17f077d35b.tmp
Size 25KB
SHA256 28aa8dc5ff620397e6bb680e69a1a8310dfb94d389c30ea06d67739a9a2200e1
MD5 048c7d6260a98746e8f1c3ce932b74e5
SHA1 8f1453dee7a26c3a5cbf7b823a91decc66f13045
SHA512 85b7b14669a7f56eddec2e011f1182329ff2294ba1e4922053f1e7c71675774e90d7c3fe640d65f903b0ba834aa13e128c6b1aef2c421a781180c60dee9d77e5
SSDEEP 384:n/iFiZcIY3sNA8TUNTUlI4r5mgu3WWe4zf8B7ne4JjFn/gL/7IzjoV:KFQY3hwgv5oBB5BW
TLSH
T1B2C24B72D8A4D9BBACEB8AD6A34A3A03DEF0426385DC9AC4D5DD5D1D00C71DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1b627b5-874e-43f7-a011-df58a0d1e6c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1b627b5-874e-43f7-a011-df58a0d1e6c9.tmp
Size 392B
SHA256 d19dcd5fc123ff449018b62654e6fdb279d8248f4a44ba127b2fbd1b8c57408b
MD5 ccd4025709e248d6efce4c4cb92d500d
SHA1 c19e251bf0815516bc74ed336b0aeca4b2a7f4b0
SHA512 0245fef542257cddc32eb45392d73e7f67e5dea32e716916acaecc9497cc70412dfc9fb23fa4a9a4109f0b5f1695ea31c01b1d809d9ece631ca1be679d06bcc3
TLSH
T114E00103534102FAD07D077000832B2126E7C43012B303561A2416649D223002E21F94
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 998f90a048a6afc60ee0338fee246bcb6e7caf62139f2bb42d964576b52c3ebc
MD5 2353a2e7dd41240ec2fa7bcb13c8df4b
SHA1 3cecb1c4a7cce0cadb944224a250c8b5fe4bf8fb
SHA512 cc2f763628aff01a21868dbdc9ebb3349e6f9c38c7702148ea43cb8e55eed2b1e10f9e4cca4ad6026f7c639c31d6afa9fcb4a31f05573b78e821951f571ac156
TLSH
T1E4413A58A6FA1258B3B76F5A9BF6A86D587BB8733F06C45D10110D4F0A72B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

5643cced-ab73-498a-a2d4-990171338d04.tmp

Path C:\Users\Admin\Downloads\5643cced-ab73-498a-a2d4-990171338d04.tmp
Size 25KB
SHA256 f759c0b4850485af0e6ebf2b0a6834ddd8124f9e5f22a92172d9246730ba932d
MD5 bc052cd707637a02e91d9865de5253e0
SHA1 7ffc68c8451e601b8a8a43fcce72a2c8c4b93740
SHA512 b9f839606c1fa47e4c6a58b934e297d51dd3d138380064473f715820a77933bac7b183c4996751831f0b05df89db1975661369c83b1340da552cd833662433ab
SSDEEP 768:HOcj4IjAAO8L+BePc7t0P8tVntulcwV8xh:BnjzO8LVMtVVnDwVKh
TLSH
T186C2E0EFF6D08518028E8A19E3FFE78D36B95372F7883D6515B524324AA049C94338DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashlog.txt

Path C:\Users\Admin\Downloads\release\crashlog.txt
Size 32B
SHA256 a6285359847870c414f8790dea88132ca3b482dc22ca5369d3ce2c7491825cd7
MD5 fdffc9f52bf0e7ea779dd1ae15891b04
SHA1 5b95ac4cbfdddfdb634881167b0a2f19e691400a
SHA512 d66d3a231ad1f8320a18185619f39494596b4743f08fd5c2ba56c2a4ce18add9db726220a40e35b724e7c69b910078f950a89100d35d79bcd125c08194b9f9f7
MD5 SHA1 SHA512

Submit Download