hxxps://dosya[.]co/pxb1iapludrj/Yeni_Metin_Belgesi[.]bat[.]html

Resubmissions

18/04/2026, 15:39

260418-s3sansct4x7

18/04/2026, 15:36

260418-s1396act2t4

Analysis

user interaction
yes
max time kernel
898s
max time network
899s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/04/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/pxb1iapludrj/Yeni_Metin_Belgesi.bat.html
Sample260418-s3sansct4x

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
wmic baseboard get product,manufacturer,version,serialnumber	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_227677212\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\crypto.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\wallet\super_coupon.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_2048633720\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-tokenized-card\es\strings.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1820237648\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1820237648\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_138899210\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_138899210\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_693311509\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_2048633720\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-sk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1820237648\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_591309758\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-shared-components\id\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5756	msedge.exe
6068	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	reg.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber = "SN-9019-26964"	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber = "SPOOL-99A-11728"	reg.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210003882021737"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{E50181AF-4F9D-4BD3-BF2E-6928A7AC4601}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{DDB3E916-C7EC-49DB-B3CF-6750B3D163AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
3960	msedge.exe
3960	msedge.exe
3396	WMIC.exe
3396	WMIC.exe
3396	WMIC.exe
3396	WMIC.exe
1700	WMIC.exe
1700	WMIC.exe
1700	WMIC.exe
1700	WMIC.exe
3948	msedge.exe
3948	msedge.exe
5700	msedge.exe
5700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	3396	WMIC.exe
Token: SeSecurityPrivilege	3396	WMIC.exe
Token: SeTakeOwnershipPrivilege	3396	WMIC.exe
Token: SeLoadDriverPrivilege	3396	WMIC.exe
Token: SeSystemProfilePrivilege	3396	WMIC.exe
Token: SeSystemtimePrivilege	3396	WMIC.exe
Token: SeProfSingleProcessPrivilege	3396	WMIC.exe
Token: SeIncBasePriorityPrivilege	3396	WMIC.exe
Token: SeCreatePagefilePrivilege	3396	WMIC.exe
Token: SeBackupPrivilege	3396	WMIC.exe
Token: SeRestorePrivilege	3396	WMIC.exe
Token: SeShutdownPrivilege	3396	WMIC.exe
Token: SeDebugPrivilege	3396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3396	WMIC.exe
Token: SeRemoteShutdownPrivilege	3396	WMIC.exe
Token: SeUndockPrivilege	3396	WMIC.exe
Token: SeManageVolumePrivilege	3396	WMIC.exe
Token: 33	3396	WMIC.exe
Token: 34	3396	WMIC.exe
Token: 35	3396	WMIC.exe
Token: 36	3396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3396	WMIC.exe
Token: SeSecurityPrivilege	3396	WMIC.exe
Token: SeTakeOwnershipPrivilege	3396	WMIC.exe
Token: SeLoadDriverPrivilege	3396	WMIC.exe
Token: SeSystemProfilePrivilege	3396	WMIC.exe
Token: SeSystemtimePrivilege	3396	WMIC.exe
Token: SeProfSingleProcessPrivilege	3396	WMIC.exe
Token: SeIncBasePriorityPrivilege	3396	WMIC.exe
Token: SeCreatePagefilePrivilege	3396	WMIC.exe
Token: SeBackupPrivilege	3396	WMIC.exe
Token: SeRestorePrivilege	3396	WMIC.exe
Token: SeShutdownPrivilege	3396	WMIC.exe
Token: SeDebugPrivilege	3396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3396	WMIC.exe
Token: SeRemoteShutdownPrivilege	3396	WMIC.exe
Token: SeUndockPrivilege	3396	WMIC.exe
Token: SeManageVolumePrivilege	3396	WMIC.exe
Token: 33	3396	WMIC.exe
Token: 34	3396	WMIC.exe
Token: 35	3396	WMIC.exe
Token: 36	3396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1700	WMIC.exe
Token: SeSecurityPrivilege	1700	WMIC.exe
Token: SeTakeOwnershipPrivilege	1700	WMIC.exe
Token: SeLoadDriverPrivilege	1700	WMIC.exe
Token: SeSystemProfilePrivilege	1700	WMIC.exe
Token: SeSystemtimePrivilege	1700	WMIC.exe
Token: SeProfSingleProcessPrivilege	1700	WMIC.exe
Token: SeIncBasePriorityPrivilege	1700	WMIC.exe
Token: SeCreatePagefilePrivilege	1700	WMIC.exe
Token: SeBackupPrivilege	1700	WMIC.exe
Token: SeRestorePrivilege	1700	WMIC.exe
Token: SeShutdownPrivilege	1700	WMIC.exe
Token: SeDebugPrivilege	1700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1700	WMIC.exe
Token: SeRemoteShutdownPrivilege	1700	WMIC.exe
Token: SeUndockPrivilege	1700	WMIC.exe
Token: SeManageVolumePrivilege	1700	WMIC.exe
Token: 33	1700	WMIC.exe
Token: 34	1700	WMIC.exe
Token: 35	1700	WMIC.exe
Token: 36	1700	WMIC.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 4756	5524	msedge.exe	82
PID 5524 wrote to memory of 5756	5524	msedge.exe	83
PID 5524 wrote to memory of 440	5524	msedge.exe	84
PID 5524 wrote to memory of 440	5524	msedge.exe	84
PID 5524 wrote to memory of 440	5524	msedge.exe	84
PID 5524 wrote to memory of 5248	5524	msedge.exe	85
PID 5524 wrote to memory of 5248	5524	msedge.exe	85
PID 5524 wrote to memory of 3224	5524	msedge.exe	86
PID 5524 wrote to memory of 5448	5524	msedge.exe	87
PID 5524 wrote to memory of 3224	5524	msedge.exe	86
PID 5524 wrote to memory of 3224	5524	msedge.exe	86
PID 5524 wrote to memory of 5448	5524	msedge.exe	87
PID 5524 wrote to memory of 5448	5524	msedge.exe	87
PID 5524 wrote to memory of 3548	5524	msedge.exe	91
PID 5524 wrote to memory of 3548	5524	msedge.exe	91
PID 5524 wrote to memory of 3548	5524	msedge.exe	91
PID 5524 wrote to memory of 1464	5524	msedge.exe	93
PID 5524 wrote to memory of 1464	5524	msedge.exe	93
PID 5524 wrote to memory of 1464	5524	msedge.exe	93
PID 5524 wrote to memory of 3888	5524	msedge.exe	97
PID 5524 wrote to memory of 1240	5524	msedge.exe	98
PID 5524 wrote to memory of 3888	5524	msedge.exe	97
PID 5524 wrote to memory of 1240	5524	msedge.exe	98
PID 5524 wrote to memory of 5400	5524	msedge.exe	101
PID 5524 wrote to memory of 5400	5524	msedge.exe	101
PID 5524 wrote to memory of 5400	5524	msedge.exe	101
PID 5524 wrote to memory of 4984	5524	msedge.exe	104
PID 5524 wrote to memory of 4580	5524	msedge.exe	107
PID 5524 wrote to memory of 4580	5524	msedge.exe	107
PID 5524 wrote to memory of 4580	5524	msedge.exe	107
PID 5524 wrote to memory of 4092	5524	msedge.exe	110
PID 5524 wrote to memory of 4092	5524	msedge.exe	110
PID 5524 wrote to memory of 1292	5524	msedge.exe	115
PID 5524 wrote to memory of 3824	5524	msedge.exe	116
PID 5524 wrote to memory of 648	5524	msedge.exe	117
PID 5524 wrote to memory of 4076	5524	msedge.exe	118
PID 5524 wrote to memory of 4076	5524	msedge.exe	118
PID 5524 wrote to memory of 3828	5524	msedge.exe	119
PID 5524 wrote to memory of 3828	5524	msedge.exe	119
PID 5524 wrote to memory of 4532	5524	msedge.exe	124
PID 5524 wrote to memory of 4532	5524	msedge.exe	124
PID 5524 wrote to memory of 5428	5524	msedge.exe	126
PID 5524 wrote to memory of 5428	5524	msedge.exe	126
PID 5524 wrote to memory of 4876	5524	msedge.exe	127
PID 5524 wrote to memory of 4876	5524	msedge.exe	127
PID 5524 wrote to memory of 5240	5524	msedge.exe	128
PID 5524 wrote to memory of 5240	5524	msedge.exe	128
PID 5524 wrote to memory of 3960	5524	msedge.exe	129
PID 5524 wrote to memory of 4700	5524	msedge.exe	130
PID 5524 wrote to memory of 4700	5524	msedge.exe	130
PID 5524 wrote to memory of 4704	5524	msedge.exe	131
PID 5524 wrote to memory of 4704	5524	msedge.exe	131
PID 5524 wrote to memory of 4704	5524	msedge.exe	131
PID 5524 wrote to memory of 1904	5524	msedge.exe	132
PID 5524 wrote to memory of 1904	5524	msedge.exe	132
PID 5524 wrote to memory of 1904	5524	msedge.exe	132
PID 5524 wrote to memory of 5884	5524	msedge.exe	133
PID 5524 wrote to memory of 5884	5524	msedge.exe	133
PID 5524 wrote to memory of 5884	5524	msedge.exe	133
PID 5524 wrote to memory of 4200	5524	msedge.exe	134
PID 5524 wrote to memory of 4200	5524	msedge.exe	134
PID 5524 wrote to memory of 4200	5524	msedge.exe	134
PID 5524 wrote to memory of 5836	5524	msedge.exe	135
PID 5524 wrote to memory of 5836	5524	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/pxb1iapludrj/Yeni_Metin_Belgesi.bat.html
1⤵
- Suspicious clipboard content.
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x264,0x268,0x238,0x27c,0x7ffbfd1bc188,0x7ffbfd1bc194,0x7ffbfd1bc1a0
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,13813285766781399477,2086616404093435218,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,9019301026177196140,6984902896437910134,262144 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,15819247559473004751,3615645329717252720,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7655771858430392915,13645356392434613239,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,4639859476115646046,16728171961716038066,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,4615499120722453535,10425237855313665981,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5016,i,12804843556448745688,16108775600580141437,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,2440696198436525104,475253164865680449,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,8310495646980303594,16118159354937232477,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6444,i,6238663939991924071,8163871166534431105,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8407682488679631494,12045565605115415021,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8407682488679631494,12045565605115415021,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6936,i,16678821011398432073,1874290936961721464,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,6223650240737742696,14476183489555108439,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=608,i,14887731382121167242,544052972812014090,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9568207139785210238,2315221168526337742,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,6671947751786232769,1281071382502449045,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,15210744141095347609,4262787858484784316,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,13472101539302484429,5626359919068514586,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,14204400486349664847,18080003104299610704,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,5477947063323643036,2625872507168538798,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,11765962099762060611,6865659820953037089,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,3181332933582126186,13307910235265930832,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7136,i,173933693727945367,7472722011649804409,262144 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=608,i,4552797895834892743,85930998259999714,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6924,i,16502068039201488966,5751945788701110768,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5544,i,5869915221363980916,3306351039732707135,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3004,i,8040837281654542894,14659464494289865679,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7384,i,8201979971657006818,16805441472862895520,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7496,i,1653922501940032823,11892587033483898564,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7256,i,460348315164220382,11155838632442557865,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7396,i,4807473729184320674,15197709729119184584,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7608,i,16747500057615072375,4844119558031289781,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8004,i,14843593519236474359,13281517954811945598,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8016,i,307939723769985096,12705619682231139420,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8560,i,10173245053309631280,2401570700429859474,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8748,i,11746786820262072707,14406217227045047899,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8408,i,1583496894899192635,12074625521520712926,2097152 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8932,i,5980187934119273919,5186735154805356538,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8564,i,10188847946480534849,15088931406528585312,524288 --field-trial-handle=2364,i,15381355625864362044,12124156949255343240,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x240,0x288,0x7ffbfd1bc188,0x7ffbfd1bc194,0x7ffbfd1bc1a0
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,15233877982704186671,10427082532886794751,262144 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,3676299025117932390,8938802219822871485,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,15900665463622172243,11794373984736553566,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,7731969431761540880,3600827479829228503,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,7731969431761540880,3600827479829228503,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,1211431932044981298,14864195505829650038,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,1442674880467984758,11467923415809546974,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,1906950857439226138,3016599716365295350,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,11699405365721070405,1570113325388927552,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,2140588843346956510,15673734071322474876,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,7812332149393917210,15907299012857894359,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=776,i,16135944503118126813,4386428496548390833,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4484,i,3172585700267717705,14476732282459097827,262144 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,14300656877285775659,12276927814230407510,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2840,i,3341782341600606889,12012103145649087899,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,10576051345713431512,11903978802566386893,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,8835671889515953974,6121241860235616819,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17404648699263118365,6075887694449286967,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:8
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2840,i,15204404330664786108,13860843439664669026,524288 --field-trial-handle=2288,i,15087840147722579600,1805188797555568921,262144 --variations-seed-version --mojo-platform-channel-handle=1552 /prefetch:8
    3⤵
    PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2752
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get product,manufacturer,version,serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get product,manufacturer,version,serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Yeni Metin Belgesi.bat"
1⤵
PID:2040
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS" /v "BaseBoardSerialNumber" /t REG_SZ /d "SPOOL-99A-11728" /f
  2⤵
  - Enumerates system info in registry
  PID:3688
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS" /v "SystemSerialNumber" /t REG_SZ /d "SN-9019-26964" /f
  2⤵
  - Enumerates system info in registry
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b8cc4ceef869cc7e579655e34475c9fbc626d8ee5753976cf75f334206ae915
MD5 834610710d4c818c795f7fceefd6e2d0
SHA1 7b09717ed913c6ad46d8d01768df681bd2cfd392
SHA512 39976bd2f9cd44f7c091e21183284bbb05009f83c83dbaab15503225650b11fe403509f0f94e9155fcfd10c66e4cc79c4260179136b9720fc353fcde4c756780
TLSH
T131D023387D99DC16C5392033036153752357CD013C538585B52D402CDCD867B67EE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 198230d235957f4b93cc3ae678224f011ad7bfb90aed8232eaba3b2e2c70a46e
MD5 092236e4f6f26e719051fd29e6a012b1
SHA1 1662e1f873df54bec56c72f5cfb27f4da2693508
SHA512 4eacec073963fd30ad2f39587568703d92653d83607d9b73c3478c95c03a2489b9a2b11af64cb1471ed5443fe5c03e1fccf3fb1a94eae50929c0fb981fda71d1
TLSH
T163D097747C184C09C964243304A083503312C8012C228240212808BCAC859B133DD1CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5a6b2ea966d7c2e29c3b14fe5ff08dca68086f3fd994aa9c0bf2cc11e204ad28
MD5 0169237bd6f6f5b44d541b772e932e64
SHA1 a6918145ebf462db8aee7488c845e32b14d1d44e
SHA512 0fb2297e8028511e642b18ca13e8e946369e4d4617e87e50fa23e85f26498f70911ebc8ac9b7ee959c2975cb7d270af96de7f29910e2160dba312e3ae4eb48b0
TLSH
T1EFD023707C184C09C960243304F083503312C4023C338240313808BCFC849B133DD1CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40a64a56a478a0fd099a66c59798b6e279b6b7a22b9c8f9d0e45f56135026fa1
MD5 032db306dcef8996b2e04b1c5fb92915
SHA1 02e99bb7c04d80a0b1c444a4a3141092712f9615
SHA512 12a489ea13d1adccd0f85ea48f28ceabf79d50bb27aa46f0f1f6549e12735380b43d6896a6cf0d0fe25fa658a6b4710cab9bb1e977ad5ee1195bab21537d0a4a
TLSH
T1B7D0806C15715C35CCD66970059577293736C862AD5397561877243C0CC345119AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 20f6708b21f715d43600ef4ab77a4f796e109be8739478559100b90b0a36aee5
MD5 62814173c84998bef41bfb7f0ebb4e72
SHA1 44b9caf35cae2566e5ae017303f4d079d505142f
SHA512 0c2afd69116eb7c78f80be5e40aebd9a903bfaccdeb8e2fcd3759c9ee4710795b3dd83f246f3d827f8a9a1a88313d00fcd50f48f832727a6eea7d909ea153c78
TLSH
T1FEE02684B383CDF9428AB7C7D68CB734485E752AE1AC9CB9B3C4B8BE7C047405653482
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d61e8847f33b25a5edc49fb8f09c22f46ce854a53757386e190b2998b53a6105
MD5 6d83ae8b6b1beffefc0de3e639649215
SHA1 80b1b2a5f2c7b8cc3322e6d397497d976bb9b3f2
SHA512 bc6a5c042ce6de0050fee69d57fb4e5e65773e0b3ea16d7384015138ed7f0a9b33d03391a83766df6c63a40f2abcf2bb3bf5106d47215319fe6546e589ec3d5d
TLSH
T1C9E0261427E6D5F2978AB5D786BD773861423007D99C49AABECCB896344A30A93037C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 830e7b596a84a7cb3923b475b7a11afd3fc8e026c9df2657dcb7c4fef8344adf
MD5 4a3c46f0ed5775456cd9528f5908e9b4
SHA1 4cbc85027416cda3ca59b9e55b80cdcbb2075f7b
SHA512 642464b88316479da12a3f1c4221af229e388ae4c5b92be5c5d11203537ba6a12671c06b9492d07ac20c00f869b5ac5de31b6f32b9baa247ad21df280b3b3574
TLSH
T132E02BAAC9119C3708FD071D64544749EA94135B2B419D4F3B3C950CCFB467A46D381C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 29KB
SHA256 c9530bd11b57e093fbc4bc2939cf5ed17be9da3638f0d6a1c74e1fe314a4dbf7
MD5 a4e4dbeebe115cd3ec69fbeda0bee032
SHA1 782410914edeee647b47e4baa756983fcc274ec4
SHA512 dd53a6443843dfadc363fd50d4cab8a780f9a35a7fe75a7ac25560996701db1463c6c675655391ffd770374dfe999b60ac0f3182fe5e5fe077acf94bfea7505c
SSDEEP 384:/KkjfqpcDlrmFdOdLMTtoMOlPHey5kdhc6cmGW7wp1zVccbMlbpnDQrKOow1pavh:/njfqYlc6MhOZHeQkK2w6SqDVOhDmb6W
TLSH
T101D2E1D6B49F2B0475DF25D63372F69293EB8FAD3274A077807952A085070A50ADD1C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010e
Size 21KB
SHA256 23e3ee7f519a90823d1818ce0238da4021eaef8ab73f529ebec522eee99315bf
MD5 ea36283a5b25f9d7a0f2bdacde5bdc6f
SHA1 136c21ccb383a16fe026f24bb7d93aac265550ee
SHA512 5219f4d7dcb2309de7aa913f7d2ab13510b2b31face17a2008109812c2a6c94a597a386967f2b41dbd8ecd7f42bfea2144aa5b5ae9f137357f33e9e2719a4126
SSDEEP 384:XiDBk/eny8gkR9L/JSCt4jTUH3Xad9xAV5+xdGpYg25pxL5J4MHZTOqpDt7n:wk/enydw9LBSCtqUH3XCwV5+xdGpk5sa
TLSH
T1B9A2E18E3D5243D324F881545D3B5664294B39CBABBF939562443106F223AA97BB2CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 e0bad437e18243faafa89fb82ecf7acc6e61e5d24369d984f31811335e0f765a
MD5 e979ddb8a98904dd1756390be065b73f
SHA1 00f06ecda644b9232e0fbef655c5edb363989a45
SHA512 c69e38ea51c3745358134cef76547c6af16ec8a37cacc6599a2e24452fc94d15b428be7d3449a43a90a3117f7489361d02fbbd996a596f7014c365ca4a7d1d3a
SSDEEP 192:wKn3jH2urjaVl0korbzbx4ohIqxxQUXLLdAsuwnC8W:/n3jH2WaVl0koPzbx42IiWUbL7ZC8W
TLSH
T132026F0195EEF098FBD902B086D7AAA77738458B0C1F0E1703E1467E8DEABB79593034
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 ed51a76b36d5bc004d5b728d94da8c00f9f808f7a483b24b82baf2f1291ae7d3
MD5 ae4ffd90f6c9fadcd9c1a56ca67b90eb
SHA1 ab4e25021096f36f4a9c0697eeabd9ba4f3fd1d6
SHA512 116a7cf9e42fe387425216d99392ab8e885a1028a6af51c4ceee10a8281dbf44bd35715b10dd5a0655e821a9ce90a1e3071ba65e8907f993d1149d8b92c44c3b
SSDEEP 96:RpTaWLerLaZ1FMl0xEnkmFZZ9BdXvZGosxxV8Uxq129Rc6dAsx3a9jQA:FiLu1ml0Ov9LXBGosxMUJdAsx3G
TLSH
T1A5E12B0195FEF099EBE906F092D3A8937738498B0C1F0E1613E5567E8ECABB79193474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5910de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5910de.TMP
Size 3KB
SHA256 46db632b4fecef6aa9ba53d8dfebab0e6060bc9e33a3c200a7871309fe918f13
MD5 1de37592969c6e96a1cbde27931a13eb
SHA1 1d8e6d88220c3f6cacea0f39c921e5005dcbc604
SHA512 ce1389d9c1f0aa3d7217b62a42451d4dc60e768e416c70263287f2b9a0ec9f89604b1a0e469cc7cfa1bd96f2bae83fa5903da3b4aa6de7ad43ef8700d950aacd
TLSH
T1D2615B4412F7B4E8E3E081B0E3E7D0917A30465A0C472E2623EA967E8AD6F77E587430
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 292d95b1eaf8508b792c2f0add4579bf3300cb4aaa7edf73e59e4b10f04ac888
MD5 15769c9673c53d348f9e6902fc258bb9
SHA1 ba903a2248450ac2c910a4e29be90e864fc7d800
SHA512 264e158abe3f9f5b9f939eb5461dbe5194b67017415e5291761cb05087a402f1bb1ed4e1744f20f20cfb02b52b305c51608654019b428f249a2909c80dde1ec3
TLSH
T1BBE0268456CFC1B9A15479D782AFB70882D33413A288390227488C80720234DA3F7284
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 32KB
SHA256 aae276e2b3867ef5930e9ed1e9cd08e06583d67413522089bcdbd49afa5c7d11
MD5 b4376b56621ef8c641476f9db98c4f78
SHA1 ca7cf6606e04bcee48c36f152f3836f903d88871
SHA512 4f9d86a59886889eb9633ed6bde6b3664368eea4ee00a12782bae5a3044e9fde59c23a47bad3921a13b13acb5be3c515d3cb1775955b965622575ecee35efaf2
SSDEEP 384:cIwpcUw01zmoJu4FoFeTR41XzSPaJc2Xy:dKrmoJvoMTR4lSPycq
TLSH
T138E27C73ED3A7842CFC5AFF7216922B2EA73C11C4ED2CD5D786714A909390532439A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 05ff2e450c5c5a7eee7a36591b1849b7fa6569a95340049497608bc45f54a6ff
MD5 1e9eac2a635ee932b9a4b8f26cdf1903
SHA1 2186e733988640a15d67ff7aa30ba0fa257d7e87
SHA512 55b0a4b3d1d39b44ae411b955b06cde0c3feda292233f70998ad7f8e6e85ea4400100573c106920ce441617f5d12e56cae4f6c8776375eb2073149386bf2a87f
SSDEEP 384:b6ygzhw5/83uICtTBBV6cRlOBNLp7DXspU3iZ:ukptTBB0WowU3e
TLSH
T19514A66F1F263711CDBC92B268FA15E26D6DF02F8B4295DA68B110F0CEE7613501D4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b378273a549ad08aa9a8eaada1c71e091c2d1a1df0cfda28e704bec7918279b5
MD5 29af6fb009e20b7bf8f85c25df06f2d6
SHA1 1cab1e9a6c8f1a163e0da7c3f06f257360c981d9
SHA512 d206b724019f89251308db2be0c2a52f6e44a6469f4b1ae727f6c07f3746d16e4b73bcaa7ea71b32212ba498c6ea1dda536eb5c4bbadf3e1b6bceea3bf6c818e
SSDEEP 192:DcZi6yirNZGrRM6TZNMTHMIZoQj1iHljy2gimj6RMVE1v4ffnVU57HpcZpDGih:DcZi6yirNZGrRMgZNMTHMIZoQj1iHlji
TLSH
T16912BBF7C3F4862DD91152F4AA286F1FDE190956436C3C4A85E4AF4FA3F2470E191A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 31KB
SHA256 1e87574ee9e64d2891e7cb10dc5f50461583b26743421fbcfd772b62b4455622
MD5 cbcdb92d007ddf988dd987985fd8dfcf
SHA1 f82fd7d8b86e721ce0b7ee627029356fc8be50c6
SHA512 f7d200e880fcf6b1b3a9dad38138dc6d07d66a69314ec7772ace24d7395e61f66e0361f8974a722ab1b0ca8a0c47a1dfbba0232f4dbee859c07bcdc28ab1dc90
SSDEEP 384:DcZi6yirNZGrRQz43kg2C22BeXexoeMPrMPDZqJC7eNJ/gEje9eyJjgZNMTHMIZb:ADYp48aqAsYfo+gVUji4Ti
TLSH
T182E29BF7C3F6852DCA11A1F1AA186E16CF6D0954036C3D4AC5D8BE0BA7F14A1E345E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fb4a4ecfbc2a748079432ee8a8b50461871ce18a211b58a687a2848ebb37e7fc
MD5 2476b0ea5ef466a94afb2976871697e7
SHA1 51628e0b756a5c4282b897a6b6d68c1a3e7a87ae
SHA512 0ef9022233d38b0df38cef521a6f703f02f5803163c430de4961103c2304d385bcae61a8948c5fe23cbd9b1f7a6080fa8211e5184081fe51e3e1cabe419e98ab
TLSH
T1F6D022E33305B0BAB66E2E9164EAEC8FD73610621883D9F611E0AEAC0D3186D5717240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 432f42663644b1523f85e514cc22228e2f17a40956bd07726ad958dd055dc9cf
MD5 15bd072bd1951af079a4542a8cec694b
SHA1 f3996eb68f7fb594434fb4c5242d2190b64194b0
SHA512 e878ee92db8d22c6b9155e41fef0f6ade4a31c1e8121f0cfd5e8435903f9f323aa6bce0c743673bea951873abb22be552ce0de89cce4150d071a9d4be5ed0075
SSDEEP 768:sjbBjCm4M/fDYecq0Hbx9pljsWLlBCOEdT/GJ:gBGm4kYecqAfp9EdjS
TLSH
T178D2A697A0344ABB89D78536F464FF3AD2A51417CF948E85AEECCE0C04DBAFD6501C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 18b1ace7a4255da4b6e88e321013e475f720a408ed936e621948671c846c0219
MD5 6ca49e4d05faa6194c318cf9e4616757
SHA1 211375644ddbf73bf818aeb1d838908393de3b61
SHA512 db1ab336cfcfc1780aea2186db6ddbc0e03cffd5213ce17d87dc405274fdf37f9a0cbeb20871bc64c4f1a568c594114eff9d55d3e35a7e0e9aefbe37a4e4688f
SSDEEP 384:sxZrnb+sm1M/fmslZ5S7xCyXLyHbIGMY/sIHs5V7ElamGJ:sjb3m1M/f/Z9HbjtS27GJ
TLSH
T127A2E8466524897B8CD7D626F925BF66D7F81423CE504E8C9AFCCA0C04EB6FD210382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 660b84f0c11483be52efae6a5c967d30594dc2305e31407c287063ece533b851
MD5 901c79cd8ff9f296d4f906dcc121e62b
SHA1 59d3076c3d4e1ff14cfd9335d9c1cad21603f7dc
SHA512 11f7552783df458a16b4cd5a86a93de2db1345e1ce9c35536e0ccf6d6dc976bb7d9ed3451014ae105a5e2bf898fc7ffa1d4b07832d86c81db8246e2a2ffd857b
SSDEEP 384:sxZrno+uOM/fmsvZVfjCyHFyHbVGM/sIHs5VUSla:sjoUM/f5ZCHbftStw
TLSH
T10C820A466578493B8DD7D22AF546BB63D6F81523D6944E4899FCCF0C04E7AED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 5673273ce9744a3acc20f3bd55c9df52157ba1f44b80baeef862389bbd427eb8
MD5 d00b6663b8ae100229183aa3b74e8227
SHA1 f75476fcf307c32bf5b9cdcfdee06589c1ff7727
SHA512 45e8c174e28a506f10b7ec82d55440bcbe050cdc569dd4163fc689817029b1b286d8d59d52dc4a371dbc62e16594facc0eb95e5b0fe1ec86cd27ded53f170363
SSDEEP 768:wsk8n2l7pLuLn4vWvP5OF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+I/eLlkqHdvro/:wsk8n2zEn4vWvP5OFu1jaXI/eLiId8yg
TLSH
T1B2F20C3B280CCB7E4F800E9DDC2A7E9E6DE4028F96D8895447F9984C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c677e9e9e6762d5fbf6126982d921b084715faef56311285ae61f667f6844381
MD5 c0a527869157fbfc89c50df12de4cb85
SHA1 8936e0357f6e70fd0451a28b572c5cb660930a0b
SHA512 a776bfcac274689284185b86284939478fe309ca5b0486619ebb0e38dc8f9fa853fd630f1e2ef65454894989c50483c4c332c72ff101f4646c75a623db8b3a74
SSDEEP 768:wsk8n557pLuL/PvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeI/eLlkqHdvroY:wsk8n5PE/PvWvP5kFu1jafI/eLiId8yz
TLSH
T115F2FB3B280CCB7E4F800E9CDC2A7E9E6DE802CF96D8895447E9944C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8165a7b97378a15080f95499193d19d486820842c2dc1fb3880e8455e7ce33e8
MD5 5e94d1e01d27f5cd00bd3b86f376abd6
SHA1 91868be041868bf5c98c1815a64cb7c04b73d120
SHA512 bd9cc65fb8f546d2b39defcdc7d011f2d6741a254e2c5e35629eaaee8214b32502eccec0f102c3ea3058a6c9373e423228aed1fb9056f9d952aab7ac628210f4
SSDEEP 768:wvk8n557pLuL/PvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeI/eLlkqHdvro2:wvk8n5PE/PvWvP5kFu1jafI/eLiId8vu
TLSH
T196F2FB3B280CCB7E4F800E9CDC2A7E9E6DE401CF96D8895447E9984C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c3e0521-848d-4e26-9377-0c26739a7ebf\index-dir\the-real-index
Size 144B
SHA256 7fe738f8057adeee3a93fd30c1efdc02c8bd17070d06738278d4ea0923ac0df7
MD5 22029246ce8c537aeff8839c6160210e
SHA1 249828c29c89077f0c015ee31f6de9ff08c2258f
SHA512 d64393f992a5280c4bb7b03780620544729b5302387d4a67028cff32a68ffdd18cb2c0f51ae5098aa475519c8309fb0f5508386a4ce32fbf19033b5fdd16eaff
TLSH
T173C0123A97305DC5DC4ED3B3FCC74A8658D50F329162230692D0F8F495B93805982309
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59047b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c3e0521-848d-4e26-9377-0c26739a7ebf\index-dir\the-real-index~RFe59047b.TMP
Size 120B
SHA256 1c040e86b79f3af7b5d8896c0b754b89e877d34c391243f79d2d49a895b8b7c7
MD5 6251aa977f1177a99d057f8e85d92c2f
SHA1 96826697c18ce8a191683618a7170741d82180ff
SHA512 b4442d3870a5e1a32329220d4e04c5161d264eb6e7b92d7fa9dec03ac596db62797f06a5d17cc8bc73e864fc4bbfc15df7427c454108a8f195a9fe4dd28a991e
TLSH
T140B012190A0B0281C909107BF603494185E14C200C409323C3E7F06496361904E03311
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\34087cf4-1be2-4a62-934b-1be671cf224f\index-dir\the-real-index
Size 72B
SHA256 d53754b87defbccdc7789043e675c361e61d237ef9ce5652e8db7a70c37d7dda
MD5 37181e394796ed898c4daf3f75cc01c0
SHA1 ac6de87ed6e37ffd7a732fb8fcddcde08f4967fb
SHA512 20345dbfc3e63df8d53c1c421ff6a479ad4941643de355527ba18edb7ff58fedf5b9728209552583bcf794aefb9351c85c1febc5649cf7c18a767a281bd454a0
TLSH
T110A0022443984001C02A52B466D68B522320C9510306530F4A960449CC905C74D6218C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588ac6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\34087cf4-1be2-4a62-934b-1be671cf224f\index-dir\the-real-index~RFe588ac6.TMP
Size 72B
SHA256 1459777ddf22b800fd284e044a00bbba6e0e8d5671e10b68a5559b43b06bad10
MD5 0c0b4bc395f6d629e30e9f43f3d8fb53
SHA1 0dfb5aa349dfdcf566b83f05d3d7f01172c279f9
SHA512 5d01adcaa05233bde0e35a0538fa4b862f29a2dd2a5292eade3109c556ab7e20f9838bd85a9e404721dd63c5db8e60e4bf8dfdc0e8209a97ae30118f912fe294
TLSH
T1E3A0025503814405C0129DF11552239116018C111616330740A214CCDE9099187820BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ab9107dd-beaf-4132-8f9e-ad2079facf45\index-dir\the-real-index
Size 2KB
SHA256 29e0749066f8e084427d85c4ed6b27288d735cb36af001e0b907c9a8f7cfcb13
MD5 8ddc84413bbeea3fdd88399555486912
SHA1 fff6ad240f9a530b023e696624a1819646f5e8d4
SHA512 9955592c50071121f4ef98e6ae123978f6b02e8f0b1e136a044e3bdc578bbe883d80e93ca69a8eb20b6894072a6a0f1472280f36353d90d4fc056cbdba87aea4
TLSH
T1BB51B61DAC0B5F65CDB825B608B618463378E4CEBFF44B07E99D5D75341232E1E4A427
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ab9107dd-beaf-4132-8f9e-ad2079facf45\index-dir\the-real-index~RFe589c0c.TMP
Size 2KB
SHA256 8a988fb348203743f25c6978f09cad412e5ca6a182f4d42727eebfc12b048a68
MD5 d31bffa9846089f572de9c663554b50b
SHA1 ddcce6bfa4a0e22d32aee87fd827765aca6ea724
SHA512 6a49a43bd627251e3793e4934e4768e52840580ced1885ad604372b50872bc3ba347c9ff6d68899e921a783d7d369c4a58ec265bb30215d72565ee6afa01d83b
TLSH
T18051E95E9C430A32CDA091B355CA6468333D68958948AF0735FCCA33BCC37AD3D56394
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f30171ad-009b-439e-9c84-062411dbcba5\index-dir\the-real-index
Size 72B
SHA256 eea6eece95886d57a3effc75cfb5ccf3e6df75329a36c7c42fb6645f7bfecf40
MD5 440ee313bbb24115903ccedfb82a3d75
SHA1 209d218a424c9a15f775d53a3b93809176ac912e
SHA512 ad4d9c8341179a91acbe3aa98cbcbc074ba8b22cbd1732ed468367a2c238eeae6118530394515bb359f3d3173694474d64fb7f1494b9897fb1c4e6756c8ce07d
TLSH
T121A0027007DC4453C0490BF162CA01923324DD260201971741A2AE65CD5616A4D41055
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 f5ef8f94e65798afdc3cea5802cef8438e637b2d9ca1432da6f39a6c80a3cc88
MD5 cc9b25405d20c7ace37c6027542440b9
SHA1 77b1960951a20d402e23a4bf3f6834a7455302a3
SHA512 f0eeef17c02f71a07f09eb410ad50aea49a3d257f205470215ab22993dc5ad2dab677cd9835d83d0213a56f1d81241d276dda6c0a93bfb03df3f46928d2b7e4a
TLSH
T1F9F097AB2AF71804F8BAE3E834318074000078058155EC1F2023A29254B2754295AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 476B
SHA256 7430c49f1722987d3e4af8cdde6e764644940d616956adc9af0117c620f710dc
MD5 ce23fc0192e4898f703578309f8f6294
SHA1 8ea1d46cf442b18c835362088b8d0904dc7dff27
SHA512 fb80804f35ad29544a6e3f164a61fe0d082047bbc7bc4de7dd112749c14398f1bab13daa7a3f43002f5e82a263387a5837342cbb46d885c27f35afd94fe409be
TLSH
T137F027BB2EF71914F9BAE3E93471507401417806C554EC0F3023A59654B2664295EC66
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 21KB
SHA256 5d8cb64b6625ef0b264ec89b7d540cc3abef5013b0bc631ea9a77b0a01a443d6
MD5 955ee4ff772577952cb6459f89ce90ad
SHA1 2ea83d87e4e4895e05d3e98dc22e1837159b0640
SHA512 c89154d9736d2ecc462536a03e59eb81585f1046c74fb25347eb3dddca8fdcb05a0f0cb954b7c126460e04c12d0aebc19581f94e2b8251182f67f7d67b109332
SSDEEP 192:F1YHeWr5Z4/4EW25Z4/tW55Z4/wL/XpNDIDV8ZKF:F1QZr56/4L256/I556/wL/XDDIDV8ZKF
TLSH
T1D3A200A69B10E08384C8B7EB1036F5D9991ED9437AFF8BA142ED8F6D91413D36324B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 2d0b4b75ba38983ad1f1194ed813efc57dc1fb4d2ba3b590e7f28c617131eaa8
MD5 3d37e53300f42cb3e82464565dd05672
SHA1 685ec287751890c94ac6ac8caf5946803fe101bc
SHA512 56db8252f702910798b75d23c76247015bc0d0b5ce7dc9f27922f444e580f9d80fc5381446094b9ef066c2aa66161813771f31c826c58ad910f18ac3c92620c2
TLSH
T173E0DF5017CAC5F9709576C706BEA30882E5754BD3ECF9022F8088407987704B693180
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 92e12f2df12a3dc3f7fb8ea6c5dc434d3a6078f5a50878eb233767ff8dc83368
MD5 fed26e9759e34705e4446ec0eaa90cd7
SHA1 ba8def800e6b373f9d45af5609220708001fadcb
SHA512 72578e43d2f7794055b83c5f01b9c9cd78f8b18d2c914625d21523910a9829051c29d66fa7c4ceef5584e31feffc3f38f8045395f2e7fc0e07b28b68d20e5192
TLSH
T14BA0023D82595086D1080B70949181862320D8590617232180E512FCB95198141A6007
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5897d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5897d6.TMP
Size 72B
SHA256 18a8e9b0a226e2029e70052f1722db7763152b1b4f77b7a621cce2bbe5b40f08
MD5 682662abb42ac4402d98eae517bbee3c
SHA1 9c00de0da1469fab37a81c037cd8ac06171e3cf7
SHA512 2ec088039870dcb69c4ac35bfbc9b474cb28c769ebbe7857a085321c2489c87b46cb8c02786aff4d68c7c6060a4c8ce7eea03add932dc752fdc96dafccc2e3fa
TLSH
T1ECA00227824A3501D8280ABA150522446360C8990804524644D0B2ECECE50D09EC2123
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 394B
SHA256 9940973d6814176300a4456fa4e6680001f75c3855b562437738ec834e668a36
MD5 a3edbc9d4d2651e40d72786c0f5cd6a8
SHA1 b956fcbce4296af905316881e98d6e3fb56741fa
SHA512 9469c523d180dcbe74fbebd51cd9a2ff3e05956e680490e7ea402b06b2d0bf8b6982a37b5042720df5b86a61582ef3bea22db61f89d8aee486bb5e5119038e0a
TLSH
T1A2E0201CBB645207DC47967934607B2BEF29E8C9110DC0AB8A2DBD436D4B6B06D471F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 b4bfb9e594e2aa172b815d0d6f99f2ed98b13f13eb046db221e243d530dbb97c
MD5 4823e9ca500976ab138d5088e5b71a06
SHA1 838325de76f162dbad7591b5609f5d293d4f4d2e
SHA512 292885846350f0585969d9b9f3d86f7fbe977694ca37a8a24e5f04769f8ef8dd672e44b3ad2eeb53fd69156386151b0f7e4408496cc18f3de8628e1cc8ca4bba
TLSH
T1D3E0D8202BCBC7BA718531C7466FE308C2A37517D7DCE9212B09AD4072477407283540
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 ae900832bd802022a2bdd8217d05e71c5d9e2878d8e1e9de8b3988b7b471339d
MD5 38feb3848939b2fd01e4427f58388541
SHA1 b9db76c480b94193f968ce671f5a25b01f111527
SHA512 a852a14b0eb795f510f11d76651f3779eef0e16e1ff7f73aad5302b2f09a620691bfc37129fda5147e5c513e47a421c54c727cf2d10948e7edba082c7e08e684
TLSH
T1F1E04FB05BCAC6F9614572C342AEA70982A17A17D798FA5697084851B642344B2B6584
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 dfe5ddba3c851177a2b542334c3d79cad3dbb77a9054ad4271d5e148a19611af
MD5 744eeb14dd4977f39e9b4d481801cc1f
SHA1 ce701c11b9e720341bc85ba759d477ac8bbc55f3
SHA512 799f94b3f704ef21a2eec13797d69b60795b4304d1a1d358f2133f707b615b954b66bb97a146708fb8a3248801f8f90e87e613103551a1fa0fb5a0108e4be01f
SSDEEP 96:KcKoKziqGxeK6wyKawKfKAtKKOwSqSYKDCE9+KOAauVOK+0ZwQKpK+KKEKzCssAk:eflBf6532xxBzXcn5H3POrXOLft
TLSH
T1E2B21551713A02913A7EA9CA8596B81E46C331737418E43B7BB900B61F6BE20DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 243B
SHA256 99b5da82733e318eb2d7f78574ad27f6920d574f2b66abca271b492f5365da9a
MD5 641f2af2a9eb9f51596cee2739bf0d2a
SHA1 869866b2e884e5aa93ab3d10a3f906f3b8283f9f
SHA512 ba0f1484c3bdd8a6cac395eece9b9b78dcab912e17b9059246f9a6d28da1547080146b6ccab276388f787433865f0248f6d728062cb1602b94bb8ddfddc7d6bf
TLSH
T182D0A7DFBBB24D5A2774ABE45534701D95168D188CC4CCECEC45B046757C732C502F66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 159B
SHA256 15eec9a1c23f68981ff65710799b3876064710dfcf4cfb4e5b38b1e5902bfad6
MD5 340a6498c05be33e164e2788692bbbc1
SHA1 3b7f7cbedcdfd253a289325c08f4f30b0dae7e96
SHA512 a9bb9f53dd4e46c6e10dfce67ad2762a41280750cba8fb615686f9afb6dc1a873d26d4d08de2e5192ae0ab276a28f96ecbd8ba42f89835f762546f5d7da7c2d0
TLSH
T1E6C08CEB2A608E8B0675EBD82430722DE21B814C8CD4CCF8F8488006A13CA224903F65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2423.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5a2423.TMP
Size 166B
SHA256 6d0d45ced92a6c60eba109cfdeb196a121fe859a51aa4b3b11121528ac384d8f
MD5 cf0985667a6210bf43ab127e667944fa
SHA1 a85aa91e47db1175fa78071f781f544d05e030d0
SHA512 d2c9aff8a0a079f01e5a32d90e40b982f2bb36da8c22632f87010817fb3339d698e396f6740921518f22814662aaf8434c5222b97a86dcf668940570466ea898
TLSH
T1DEC080DB15208D56077197D51430711DD1178C4C4CC4CCE4F4497005703C5234506B15
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

c09f6330-1bca-4c87-b43c-8e3090fdd38e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c09f6330-1bca-4c87-b43c-8e3090fdd38e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 e5a57f5aaa8bb3416cbae97810d613a4f046566f284a02774270cff055758429
MD5 55e3a826b21de921101a105275cbdb88
SHA1 073f405f84d1824f81330ba09cbe18d918136815
SHA512 dae6a053c9af96c0f2123c17553a9237df2996fc6be6f90ba6256336a369a9dbd1a843e5febbb65cfc3ed3115c5f64c2d0a60ffdbccd2c8e37bdcb5de94bae35
SSDEEP 192:OVOP1AsKl8+NCsCFTU3Nk/v1ozqq1ozVlMQN5tIIIIbwMIMi3YcYOT0ivPRvPx:xPmsgssCGNtQFIIIIbwMIMuBDv9x
TLSH
T1C27293666A155733C2AE2F770264C7854BD6EC4649F132AE3020288F5CF3A53CBC52F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 948410d18c863c6e280d8f34658f671d76808f1e518252a09e0dea7cd71497dc
MD5 38d3111aa816daf50d2f3c471eeb207b
SHA1 9053cc14a0556fb77a08e4c8487b12f7b09a2b89
SHA512 ecfce26213991a417e32fa7b560997b971b9e7b04c904702b3dbd458e25cbff58fa1360045fabf255cf883d762147483be51ba5efc0e0126b1a23b18fe6205d5
TLSH
T1D2E04F51AACEC5EFB16435C701AEA38C93923917FB9869566B058849B202348B6A7581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 28904f0ab11dbb633b39ef671e75bab8f454bb98030c22861c2d355d6f61a42e
MD5 56cf2903e81d344dcc838d3ad5b9bbd5
SHA1 4333d3d11ce8f92829dc0c41507456794570f78b
SHA512 3a6155fed3aa5ccffc5e5e23c50f7ad29604f3e1786e40991645e311aebdb9043dbcecab319a5831d9533e9832b1837936d6d8a64d43e0e0f1138f8fd4339872
TLSH
T1B0219016F321C248E14E873DA12A9B391338E8569FBCED0F957920356D75E011E8B6E2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 cce9396aacd6c600c9b66f16d21f988754b5d5afc77911088c334923fde495ea
MD5 ab8e67cf38b6033e0096bc7206080559
SHA1 2bd0369d03d20ffed4c3d8266a90856d8325bd40
SHA512 b6ae6a2acb0cdce9d96ccfce4101e49669bd27efd32016255a1dc0abfa6d389093c0748628e065e8e5187e6f58a215f1692af3ffbe4bb877eb29d8ec7fbe4482
TLSH
T1C2E0DF10BACEC1EFA16035C301BEE38C83923813FB982E026F018D48B202349B6AB581
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1e042398a7bb86a27f4f8ce37680d3f79cb41a45fee9857563fc8fe5c4bb6620
MD5 6fe1c2963a1d94d50e7839a5109a3de3
SHA1 5fdcb257780556dc4593484d80a80c0fdf23931c
SHA512 6949fbca34f1996d210e1bf967ebd651446120f258b2798bbf52bf3f886880fb1578744eca75c5b6cc1af10631fdc75b4ef3bab9e8d7885d3674ce0a28886753
SSDEEP 384:nKiF2jccCs+Bt0S3o3sN18TUNTUlI4AiTfOABAGwl02Tvf7YwAVkYO7XB5tQzDSf:BFwccQI3AwgvP0UYwsOzBMzDSSF6P
TLSH
T12CD24A35A8A4CEABFCE78FDAE35A7613AEE00067958C5DD4DAD85D0C00871DD134BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7799b39124e60bbc7e7741797a3901ea52fc63e83b714438886effa6e9d5bb3c
MD5 352a9338292a1223b0aeee50eabecf70
SHA1 78c93b26caf4c24afa5adde8956994cb58505b94
SHA512 cf90b9f8f55d7f22d6f30ce40a9be421f6d29fd93b56a73e31680568c2db4deae4c8748bb7fe8c2b88579e597b0064b755e18d1ae63c1ba1cd689c5ecccae26b
SSDEEP 768:qFIccQv3TPwgvQ+oM0vYwsOzB7zDSSF6P:9ccQv3Tu9FfDSS0P
TLSH
T11AE2C2F598D38977E8AE4B97A37D6E029AFCC053B5885984FB841D0CCC861BFD306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 afd5527aceb59778b6054c520d1026ed163143e5aef2476f16072b587396e269
MD5 f8ce575ca6d957d0d4ac2901c6a922fb
SHA1 e0ee1b983324964a94022abfda4df26fd3473497
SHA512 e103c1f5b5cf1321396c3bd02339fe647507d33ecd5d0da8a0bfa654c15c2793ecb7aa80b8d4b258a0077e2df4d199adfe09fe432fb68e284313345c6ab1407f
SSDEEP 384:nfiF2jccCs+Bt0S3yU3sN18TUNTUlI4AiTfOABAGwl02Tvf7YwAVkYO7XB5tYzD2:qFwccQv3AwgvP0UYwsOzB0zDSSF6P
TLSH
T162D24B36A8A4CEA7ECF78F9AE3597613AEE00067858C5DD4DAD85D0D00C71DD134BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 46ef49db537fb1ad34cfecd0a631df1b3656535308be026d4b96e84654631a61
MD5 efce638de1b0500a2434e50e15feeed4
SHA1 fc4af085185ffd46fc155a7d1a20907ed82262fc
SHA512 67b4b6d23874e35e2559433507447d2118b63393b513fe9d703e01fe26397a30b2d73484ff10ec95dab221e130834c7af5025d1bd1f6826cf01d19075446c72b
SSDEEP 384:nMiFavqMg3sN+8TUNTUlImkrqOABApkVTvf7YwAVkQzVRYV/Vw1mRJrN1k+5vI++:3Fayv33wgRYpYwszVRYk1mfy
TLSH
T143C25B35EC58CEABEDEA8FD9E74A7A17EEE001ABC58C49D4D6D41E0D00D719E130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4a85fc63d343782a1cfdc99e48e35a16cbac144361daaf77d269fa33e3cbc731
MD5 97f2402b9466465964fca706b229e667
SHA1 8886c17c1192252d92c83d1781b7c1a00bdf5f98
SHA512 edc8b2f3a1685f58988b17df091c841a9179cd2cedde5cb4bb5d7abd442df727a8b61840e82841480f2b8cbe83f8c3f7fcec068777edbecb5d6a2ed8a3153568
SSDEEP 384:npiFavqMg3sN18TUNTUlI4kJTfOABAKH002Tvf7YwAVkYO7XB5tQzDUS4nrN1k+Z:AFayv3AwgEUU0UYwsOzBMzDUS4jX
TLSH
T1CEB23A75E8A4DEABECEB4F9AF7497613EEE00167998C4ED4DAD81D0D00871DD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 192b2910540747225d87da91b99a20c83dc89fc30ba52b8d4e0187ba801eeef1
MD5 7c3c7b0f15b0d4afcc8a52dd373c692b
SHA1 13ae190d60b06da3095f50160abaa8d4f34be69a
SHA512 84b5b5dd136ed04fd197791259811458d7a913847d401a163ce9263302d85fb0fa8db0596d3373e1da205221c6e3d68e2724106a0967ba934ca8185841837ede
SSDEEP 768:qF7ccQnTPwgvZ+oYdYwsOzBqjkRKBsluLSSF6P:QccQnTU9FOaKKluLSS0P
TLSH
T10D137EE99CD3893AD4AE674BA32D2D2259BCC133F5A84998F7850F0CCC6607FE706915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2a0144224b758d31594b2e19b22ae06262dacbe5651c96c5a4f02a9e2ac81c87
MD5 e0f56f317d8fb53711cd1548c94be4d9
SHA1 43b96a7ed0e47401d0d0db05842b05394dcefa72
SHA512 38063232f5f94e9ca13452aed79a4f7ab308f97b8ed368eb7f91ead4449179bad36b5818cff01462fc8b6827f2d30ba0c7f10586484c3bcc614dc9e41220bb68
SSDEEP 384:npiFJjccCs+Bt0S383sN18TUNTUlI4kiTfOABAKHR02Tvf7YwAVkYO7XB5tQzDSf:AFJccQc3AwgbUx0UYwsOzBMzDSSF6P
TLSH
T1DFC24A35A8A4CEABFCE78FDAE34A7653AEE00067858C5DD4DAD85D0D00871DD134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 03905bf5d6f9da4d4f3f8deb2bdd0c6fdaf1720cbeb856d508c02786e61d085a
MD5 b337e90f95133cbad58a611dc4f4bb95
SHA1 73c489a57b8c2a786dbd464f6d46ca7a74437e40
SHA512 4060abc7d2fd86b6e7634af47348ead1ffb8254e9baf9ec75c67f319d6bbd1816b600534a913f7d28bd1bb36c35d81786d2aa42ab3028125b2fc682b374096d1
SSDEEP 384:noiFavqMg3sNJ8TUNTUlImkrqOABApYgTvf7YwAVkYO7XB5tmzDRYV/Vw1mRJrNk:zFayv3QwgR0KYwsOzBqzDRYk1mfy
TLSH
T1CDC25B36E864DEABEDEB4FDAE74A7617EEE0016BC98C49D4DAD41D0D008719E130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f83a88707ec36469a7217aa6584bcad04d7bf2adf4c6679e5cc0c5eeca8cf82b
MD5 19c43a393e35a0c0caa12d51a4ec237e
SHA1 dda1314fd6d17b52242886bb6b28fdba601725bb
SHA512 cd280737c0df5e826a2182e497b3d1314f5a62292a7ac76885e7d6f83bc14525a295a28982c3cba9f93dd333b0be91cd516d1e5d4a74c076a78d356ae5cced3b
SSDEEP 384:nOiFvjccCs+Bt0S3y+sNi38TUNTUlI4AiTfOABAtKI+oXPTtfisYwAVk/I7s9V/E:lF7ccQnT3wgvZ+oXdYwzcs9VlSx1
TLSH
T1F9F2E5F998D3893BE8AE5787A37D2D1259BCC163B5585984F7C80E0CCC960BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 cf290fad18d81341ca9b5cc518c1866bd584c5535938ee197ac0b2249148589d
MD5 9907827b852e899e999b399356244957
SHA1 2209cd94a354f70232b19c9c749a532d2af58468
SHA512 65cebe408181df908be6461a97ec3e5cc241f9fb16418b7789e935dee2e03b12a888d360c9dd4a556fe8626d73ed322e4b429e0baba00309f1a719936fca7a8a
SSDEEP 768:qF7ccQnTPwgvK+oYdYwsOzBqjkRKBsluLSSF6P:QccQnTT9FOaKKluLSS0P
TLSH
T1FA137EE99CD3893AD4AE674BA32D2D2259BCC133F5A84998F7850F0CCC6607FE706915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 80b9e02e9ab400e1bebf0bfd3c412b2abdc337ad7d8b26f9387b62cc6c9f4f4a
MD5 7210d697b51f2368893968f6fa3fc577
SHA1 cd9d171b4fe6d0057159acaff40d17e36fe02bf7
SHA512 dbd6ce10d4ceb2191fddc5685cd06f5a5c9ed962c67d674306e4bcbf1904b4e6899c5d49a6b26ef1ee0c835ae3dd8f11d40d2c5957a97e8773f40df09aa2010e
SSDEEP 24:TLc5UOl0afDdWec9sJzmZXSeWGu9GXkGDB5fc:TA5UUDbg3LZXSeWGu9GXLjc
TLSH
T19692BF22B9302427E9DA4BB6F9474CA10EFC12AF8D677444D9E00E915562AC16B954FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b69a668f84db28913b6d0bd344a4ec5bbd505cf181793fcdcb216f9a676e9736
MD5 db8cd0f61b10c0d57b73db6efef8c4fa
SHA1 0100b9ecb11724d7912c567431010b8da1b4ed66
SHA512 91529c0e4b2358463654243bd44abf1143e4614d35d3df0cb01f41e98f363d225e9a7b703d3ef7e7f009b128f2636ce79d614d3b076cb1c368ec71f1a322adf1
TLSH
T15AE00282D60850AEC139033455931F313ED2C05450F413869A34454C3C332043FB8FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a9feb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a9feb.TMP
Size 392B
SHA256 dbd1a433ef7731e6b15d245199f4cbabc4ba5234bc20adc6640b51bdc2be4532
MD5 be333433b2ded75e7406cc37a43fb9bc
SHA1 d3240944bfd18aecd3ab65af99ec5e12257e16f1
SHA512 991f114eedccf7931d37ec4a3f900f3d143992010956371e67b65fced0101efe1a163a06348faf73105355b351945065ca5b829ef938821707c51b229e3e9736
TLSH
T1F5E00281D504505DC139033414531F312DD1805450F412859734454C2C332043B98FC0
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fc2c8c2d9fed00ad1d7135c5299cede76156d4f96833815131e28e0ba9594e93
MD5 853cebc39b8ac3f01f457cdd715d300e
SHA1 c05c8e3410efdbfc67d013ca7dbf4d145c81f539
SHA512 9030235423967a80817739d164cb4e65acd8e4ec70086d1e4c4806bac0ca9eb253e93182b5a1001adb4144f128797a007af81ad31eef506cd95436e2b315a1a7
SSDEEP 3:MsEllllkEthXllkl2zEizNK:/M/xT02zZY
TLSH
T1764404447FC44415C5411070C031C3D30770D410CF355F4334D134137CC55400C04401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b93c3edcf15a7a4d6e8aeeb4e0421bf9cb8fb114b3385fee5c7f9d96126557cd
MD5 57d2e3eb0048deb027c02104f5ca8bc0
SHA1 d5ec94fa1ab32784ddf5a29a9b38aabab9266c2c
SHA512 88c97d9985d099e0269ae98079d446a0121c4a73495baf0ea2cc2af857d3de6fc940730faa8817e5751643aa2eb297e18315a045b9b9f5ea68980e2d3b945ac1
TLSH
T10F412FE15C3E2AD1D4FE0A6E64A738FC95D8C72AF4B4707D6864DE98073960E644443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ba42e57dd0cb05403c94224757e144a0ae72237c8b047b9b988367f319892a3
MD5 ee8a569d113c36a9eb6ffb7a9951f409
SHA1 8a23ddcb915b9160112f3f9b0c20d8c2ac99f673
SHA512 5566a53767938c8c5e8fae05b4f19ee626c0ecf8ec22ac1fe4578bf3c7be3806085e46ccc3d2eebf3e2cafc1939375fe85e71ff75cb40caa8fd86af59bf00cfc
TLSH
T144412FE15C3E2AD1D0BD0A6E74AB38FC95D8C72AF9A4703D2854D998473960E654443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 966c9fc9d7b672a42d15c1892323a8792e9ecfa5528dacbe4e6d58a1e3e37d6b
MD5 ab9abcd00043164d7602b7d050ccdab6
SHA1 d2d3567fe9fd77e63642fea606341d3cbb4a05f2
SHA512 05c15f37123addc9b632bab064023bef693a0da3ca1d8c8d62145e01647f0f1f178bc83976592a81460038ce0906616a2b9483a12f4f38dd8ec91f1a070d0086
TLSH
T1D4412FE11C3C26D1D0BD0E6FB09B78FCC1E8C729F9A4717D6814DA940A3A61E608547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2874cce9e5897ff5288adaf77ae17428ffbdd1e4b4917f60cb800b06f1644117
MD5 8d59902f41900d3868f511a36507bee0
SHA1 b5d911cda31b43ce79d49ad16c9e7870bd13c5e5
SHA512 3b9fa72ab00db3ec2bdd225ccd5ac13072f08eb5e53fc0fd760d6743bf2956402717af7112ade69e89b209c00316d9f8774630aad07517debc9441632b7900ee
TLSH
T195411DE11C3826D1D5BD1A6FB09B78FCC1D8D626F9A072396814DA540A3A61E608547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77f0feaea821c3984304aacb6a8b5af74414f07bad7397bdec46041bbd52919f
MD5 8dc772c2d0c8a611a88d711749188e5c
SHA1 c95df14d4323b4224f571b04433e2e817fe220fd
SHA512 0f679350344a44a12681de1bc3ca3cd417c6b825b50eacf290a8a832d7cc609c86f9a10af34967acf528d0857bbdfb2805fd3d988d96f00661b1e6d58a5ee468
TLSH
T10B4130E14C3D2AD1D0BE0A6FB49B38FC94D8C72AF8A4703D2824D994433A61E644403F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 33837141a1fed4e19f5a540e38f63326c9789784fb5669d7f6ecd1e18180e2fd
MD5 46cc8d2d38fdd41f3c730e944c2f6494
SHA1 1f72e2da49b319f765946209ef42a111d1e139eb
SHA512 d508c2da28e44c8a00037fa1ae4a776389e2f07930b7b1e8d44683b879faed2d4b9f8e408c506ddb5baca1262556e0ef183e6ee3a954f3e2be84e2d95b4c036d
TLSH
T1594130E14C3C16D1D5BD1E7FB09B78FCC2E8D626F96076396814DA880A3A61E708547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 27ccd4c9cae95613ccbeed49cc35aa714014427214865e470e743f6a16c5e065
MD5 b9618de2679684efcb35bdf165432b54
SHA1 74617e3e6abf5cef58ee49392f557ee9c0a1865f
SHA512 a85278bf39367ae7ba3a2373f0609df3413c48aee7c42a06f77f5068548f885d31cb243711fbc7891441af3c1d38860658a1c511e79ca07e4a00d817b928316e
TLSH
T1D8513FE14C3C2AD1D1BD1E2FB09B78FCC2E8D225F9A4763D6814DA480A3A61E708547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d3602a00d66aa9ff87b5a8242c499517388fc861e55df485da57a6e4b8a5339a
MD5 b65ecbc256a56f2bd708281fedd1837d
SHA1 2d64cf4bec444c22c9b2f363e8786925c0729335
SHA512 f0e929956ba4ee3235ea35aad64c0fc91dc66120cba3c6cb23442ae14c784b8b79fc044ee1b65ce5a5f98fb38b4b621c225153dbcee6302ece804afc3472785e
TLSH
T1345130E14C3D26D0D1BD1A3FB05B78FCC5E8D625F9A4723D6854DA880A3A61EB08547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 54cb14a0bdb762a122c851dc492e1cd855350f874d47f2e72e9b3bf9960a09db
MD5 df449b4b5e0c5ac798bf94f7e8474fe5
SHA1 255c584b9fe1cbc42186a472ef8141ebc1f69bf4
SHA512 c104420aec06bd1fb95ea5dec9c0bd8f47a30c97c08c7f8c876995076788a95de4ad6bca8937e3685311a3a443514b94c8056af5089ff803e1ea9220b2118e04
TLSH
T162413EE15C3D2AD1D0BE0A6FB49B38FC94D8C32AF8A4713D2814CA94063A61E614443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e582ff8fa8dd569d280cc9824565c4fba44fa304a03f244397c16aed3413b66d
MD5 f7bd7013822bdb0a8d8cc7cc48c7cf5d
SHA1 ecc5cb21baac42ecaa994bcb43a8a6d6d66c4de4
SHA512 dcc9c61b2e480266ffdb4ccd44bf416e80fde22747e26ea838d2f976e09a2302440685a46b909340b1d2f1e629a039324d140155a25a8b5a7de446f243e0bf0a
TLSH
T111412CE15C3C2AE1D0BE0E6FB09B38FC81D8C32AF9A471796814DE94063A55EA08547F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f1f45e8ced3deb239d2d4ce397321a2c754b78f7a6563920eafb2b2f945e9d0
MD5 06dc5c684a03dd51181af09510b2c739
SHA1 0ad548e5304322cd664d3ecd42f6315230a42979
SHA512 b655c799bd1b6b748d01a1eba9a0f396e342201e0020330ebfcf8764b5c5b1aa9d166c3c01e53fdd8395d85ba6303487143ba620d54a117a74f87466c7b6f6a2
TLSH
T103411C48AAE91108B3B72F1A9BF7A8AE447ABD772E0AD49D10110E4F0567A40DD61737
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cbqlnhhd.hrp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbqlnhhd.hrp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_138899210\edge_checkout_page_validator.js
Size 990KB
SHA256 217a62797b59bdfc667227a422876ccd0f782b2ea41d33fc93c36a6a0db35b09
MD5 80cc733f42616192c044a04fc5abcf81
SHA1 1bf191a0a41ffbe64d3d92c4100421282edb02bb
SHA512 8b521e98dbb71462a19e6c783aaf62dca949befa830bacff12d0c13b3edc38e676b8cc70cd5af98dcd06fb50191747e37cde6e0779bc27515d65751af1487b42
SSDEEP 24576:cs4emRApsqvGzkJUAKjKQmwzErmdJt3LPafik0BwrpiU8LRKLRzMEiJsfaGx1huq:cs4emRAqqvGzkJUAKjKQmwzErmdJt3LC
TLSH
T128253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E4FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1591895980\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_868851295\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4228-1595-0x000001789F1B0000-0x000001789F1BC000-memory.dmp

Download

memory/4228-1253-0x00000178B7E50000-0x00000178B7EC6000-memory.dmp

Download

memory/4228-2417-0x000001789F1B0000-0x000001789F1BC000-memory.dmp

Download

memory/4228-1252-0x00000178B7D80000-0x00000178B7DC4000-memory.dmp

Download

memory/4228-1251-0x00000178B7980000-0x00000178B79A2000-memory.dmp

Download

memory/4228-2418-0x00000178B7D60000-0x00000178B7D68000-memory.dmp

Download

memory/4228-1596-0x00000178B7D60000-0x00000178B7D68000-memory.dmp

Download