hxxps://amuse-tai5[.]anadolukartallarifilm[.]com/?u0050=cGVsaW5udXIueWFsY2luQHRhaS5jb20udHI=

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://amuse-tai5.anadolukartallarifilm.com/?u0050=cGVsaW5udXIueWFsY2luQHRhaS5jb20udHI=
Sample260809-xp1gcatglh

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4064	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307757708214935"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{F7BB8874-AEDF-40E7-8EE7-5B050F1E4055}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4736	2924	msedge.exe	80
PID 2924 wrote to memory of 4976	2924	msedge.exe	84
PID 2924 wrote to memory of 4064	2924	msedge.exe	83
PID 2924 wrote to memory of 2596	2924	msedge.exe	85
PID 2924 wrote to memory of 416	2924	msedge.exe	86
PID 2924 wrote to memory of 4976	2924	msedge.exe	84
PID 2924 wrote to memory of 4116	2924	msedge.exe	87
PID 2924 wrote to memory of 4976	2924	msedge.exe	84
PID 2924 wrote to memory of 3972	2924	msedge.exe	88
PID 2924 wrote to memory of 2596	2924	msedge.exe	85
PID 2924 wrote to memory of 416	2924	msedge.exe	86
PID 2924 wrote to memory of 1288	2924	msedge.exe	89
PID 2924 wrote to memory of 416	2924	msedge.exe	86
PID 2924 wrote to memory of 4588	2924	msedge.exe	90
PID 2924 wrote to memory of 4448	2924	msedge.exe	91
PID 2924 wrote to memory of 4116	2924	msedge.exe	87
PID 2924 wrote to memory of 4116	2924	msedge.exe	87
PID 2924 wrote to memory of 3972	2924	msedge.exe	88
PID 2924 wrote to memory of 3972	2924	msedge.exe	88
PID 2924 wrote to memory of 1288	2924	msedge.exe	89
PID 2924 wrote to memory of 1288	2924	msedge.exe	89
PID 2924 wrote to memory of 4588	2924	msedge.exe	90
PID 2924 wrote to memory of 4588	2924	msedge.exe	90
PID 2924 wrote to memory of 4448	2924	msedge.exe	91
PID 2924 wrote to memory of 4448	2924	msedge.exe	91
PID 2924 wrote to memory of 3584	2924	msedge.exe	93
PID 2924 wrote to memory of 3584	2924	msedge.exe	93
PID 2924 wrote to memory of 4724	2924	msedge.exe	94
PID 2924 wrote to memory of 4724	2924	msedge.exe	94
PID 2924 wrote to memory of 660	2924	msedge.exe	95
PID 660 wrote to memory of 4880	660	msedge.exe	96
PID 2924 wrote to memory of 2884	2924	msedge.exe	98
PID 2924 wrote to memory of 1508	2924	msedge.exe	99
PID 2924 wrote to memory of 3996	2924	msedge.exe	100
PID 2924 wrote to memory of 392	2924	msedge.exe	101
PID 2924 wrote to memory of 3908	2924	msedge.exe	102
PID 2924 wrote to memory of 3908	2924	msedge.exe	102
PID 2924 wrote to memory of 3908	2924	msedge.exe	102
PID 2924 wrote to memory of 872	2924	msedge.exe	103
PID 2924 wrote to memory of 872	2924	msedge.exe	103
PID 2924 wrote to memory of 3688	2924	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://amuse-tai5.anadolukartallarifilm.com/?u0050=cGVsaW5udXIueWFsY2luQHRhaS5jb20udHI=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffe8955c188,0x7ffe8955c194,0x7ffe8955c1a0
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,10844675804392233017,9714561734841714344,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,12236115314632073514,14611112451718999440,262144 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,1359415028736967104,2434303597316852872,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:13
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3060,i,15272112332963160728,11440776411242860000,2097152 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3064,i,15678012622304288611,8958565457613053487,2097152 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3256,i,10710611311794560105,720484279599857847,2097152 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3288,i,1554435260900478673,11282016592036857616,2097152 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3316,i,13772792077626900069,15874823796271129845,2097152 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3304,i,5830135367241889725,11437966462648884094,2097152 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,8829928568262705673,12642911140360897199,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,9844847503400971012,1009606586807125691,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,6963229792461108021,7592276223792170757,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,10923479107845007703,342743034672061329,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,10923479107845007703,342743034672061329,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,13837848349131002007,663194741708424750,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17273980419400278261,16705223042538913452,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,1731079564836593112,5544172682279865702,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2552,i,13885491923157720516,1438602374797444145,2097152 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,515719900994275035,11427702947153489901,524288 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5020,i,9184546995049879784,10629665608358051808,262144 --field-trial-handle=4052,i,5081247968482528034,8437400475385465363,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8aee247f7ac8b3c43edd394dea068db34f1c340ec53d1ed85cc4cd5649841443
MD5 906d6c521a382f7780fe17384319732d
SHA1 92cd2c091ad61cc9d1b86475bbeba592e90910b2
SHA512 53bd9e95cf3dcb24bba227901ba7c70d271ed141f21d0b9cc0fa51f60ecd50965d271a12198a6c76017261a6f35f751ebbbec13eb952d990341e18bc3c607ffb
TLSH
T1ED71910422530993E36CC5F2A4D2120139F0A356C9173E8B719E38F76D29BE7C15EB2B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e52748a17e67457be251526965a08f91aa78334fb02d835e5dc8b0aeee6573f
MD5 9039f09fd77c5d9a7785a99d4bfab5d9
SHA1 4e48d3656834eb48dc05018936dc6f5cc329f618
SHA512 ae04f1e538c2a2463bdd903fe314a08bf7f24e0029f984f66388ee824f3739d5ee7d8a7b38ca7063097b79ec09a301889aa67e20608f96ec857b8a236fa4d8b6
TLSH
T16A71920022530993E36CC5F2A4D2120139F0A356C9177E4B719E78F75E29BE7D15EB2B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5930ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5930ca.TMP
Size 3KB
SHA256 3c8552a8787d3808acc71234ea29cff38df7feeb45c99ee0b05babbff131ffd5
MD5 70d7fc28b7b066cae46606c41ad0a0e8
SHA1 f8da047be7d75807c20f553dc71513fc41964554
SHA512 529452600012e7f6211114a8be73a2362d4b996047cbd6fc82f050e8060248dd8c53bcbcc6c074fc39b0e8d15222fce8590aec7c8db87ae69138042d33ee0a34
TLSH
T16361700022530993E36CC5F2A4D2120139F1A396C9177E9BB19E38F75D28BE7D15EB2B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 99556616a97d57c2d4373e4beb4c581f3e1c8eb2ae73d580dd0ab7baa0fefa24
MD5 d7379b6cc3b16961a8ae1d91b66ac791
SHA1 49860d0fdf21d3bd70c17bc73fa3e9ef51250fa7
SHA512 4da8ace8bb362adfe66482bb53c778e2c9774ba6cba3a1c276dfa6d69072086205e07adfa7c27941a8495a6388ee8fc900b4449e2a88c6efcb70a6627f8ee80c
TLSH
T14351DFB3C6E9462DE8126AF45A24BE2BCD1D091983283D2AC9D4EF1BA3D2471D101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3ae6ed73f59546b89b8bc9739833e3cccbed22707e2aff1d01b789fa06a79165
MD5 4bed8ac805896fe1ec2eaff738ab50eb
SHA1 5361bcf5e1c79985b6f7612a1092a21c2459281e
SHA512 c6de1a62fee39483ba4d6a6cc50546a2a3332cba4e04737c85f9b1dfa55aa1aea2c8231f492daa4ed74406986c62ee395e4a80237546b715427f5df3ec64e1fb
SSDEEP 192:sxZSRdyM/jK1Ml8UQ2F9/flsYZw/qZIdpPvI/W6+WNWuWS/Y0oIGArpIg5sJ:sxZSPqE9/flsYZw/Zo/bV/5fO
TLSH
T1FD52C516AA34597BCCDBD319B941BB53D6F81472D2900E54AAFCDA1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9d26c84d18c93cbf0cb78c50662686da5a1d149ea4443e55a861182ece98895c
MD5 fd2c47a383e0e217888722da9bc5717e
SHA1 d089372c99d5ce9ebd30fdea7d8b5c59aa40c38d
SHA512 578c3d01e0d53e55b845af957707f70491af1eab837724632bfa67a46b4b38a3cd6ab6d1b6c30fae8543fbc649203cce3912ea8e99552a69d7437e6c187f559d
SSDEEP 192:sxZSRdyM/jK1Ml8MF9/flsYOw/qZIdpwI/W6+WNHWS/Y0o9fArpIg5GJ:sxZSPd9/flsYOw/Z1/bf/5Rk
TLSH
T1FC52C716AA34597BCCDBD309FA45BB53D6F81473D2900E54A9FCDA1C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d5b9858e5ac36128dfc8a47ba6ad63ccc0155695dede6e9b12818f60648596e0
MD5 3652440e6e919781c5c712e23093c49b
SHA1 f2a29402f91e99790b5f9231a0108b620be22dea
SHA512 874cade327807464d96cccf3f349754efe8456cefd126e24e5d924b8e2e4ae08a2a662d9ddb944c38c12c0c06913eed500fde85f746ffe2465f920022cef5527
SSDEEP 192:zZSRdyM/jK1Ml8MF9/flszOw/qZEdpwI/W6+WNHWS/Y0oZArpIgrJ:zZSPd9/flszOw/R1/bf/5V9
TLSH
T1BC42E8126A38597BCCDBD209FA417F53D6F81573D2900D54AAFCDA1C00E2AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 9bc5f0a257cc878a992396a38ee7df6122ff7e5e1f39b5b046e0d957ad10fd70
MD5 419c7254351cda321aac586dee028614
SHA1 5dadd9da5aa0be9e6ad390451a9ac1765363b484
SHA512 18b829d55897e1a2089e8341b11fbfcab9b1d8fc74fb9a7ac905f8ae86f6d25a62f70821a355f71f7f8929dc7e0339e013b24a3f539da282efcb9e49af7fb421
SSDEEP 768:0Uc0s8Ww2YfWRm/JQy18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OQfroTz:0Uc0s8Ww2YfWRm/JQy1u1jaKBOLpTuOn
TLSH
T1DBE20A3B284CC77E4F840E9DEC26AF966ED802CBA6584D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0a6e23950c44a81699a274eee420a9d4a19e5ba22494460ad66bb3585ae943a7
MD5 20f4e826d3287150f4d4a5acabdab719
SHA1 a93e5e918d0fd7fe84c7ac743e53b736dd32f901
SHA512 3759e0930fbd5621785d4415870db93f26da2d82da57653d9d1c7ae27095ef6bba19bed47baca77a4e1e5b015bdc24331a71cb523813e942d980a8fa8356aa4d
SSDEEP 96:KwxlWHKm0gEgAoFzuugKm1uMg6+u1s2tC2MK3q4u8K7i3:pWHKm0gEJoFKuy1uMh+u1s2tnoM
TLSH
T14891669132BA13013C7E650C9276DB3A4645F2A33418B46B7BAE40720E67E155DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 cc37c29b994e8f66b91aeb19031000c0f0368f04e0a972b169396f1db42e3697
MD5 18e2ad4ab657cddcafd1ced33352c759
SHA1 063aad12b6ee65b8ecfb782fcea24253e72040d7
SHA512 8c195d0d738e4032cdf8f9556a0527ec2ed2ddc555494301336d36cee9ac47a9d677c6cd70284eaf8ca8e9594101ba289b39862d4adf1d1cea685c1942310f00
SSDEEP 192:T8No8p3Q1Q5vEu92rQmiU1txt4TEZJSufoPxzYlX+O4/+k+2NOhsqGjqC7:T8NFxf5vEUiHjWGUu8Y5+L2k+2YU37
TLSH
T1CB422A716C24AC3B5DA7A295F54B37138FB4502BDA892F54D6EC2F1C01DF59C634B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 7a6cbb9dadf458433b7881a1d519ba6b123de903acc76cba071e4872edcc7ac1
MD5 c86c114e3af194575b1b7ba058222ae4
SHA1 5fae011ad2c851078156436d5cfe183391449ff7
SHA512 d05715484f8dcd5bccdd0121d7a46f7df4c100109807735301627efdfbb8fb97049c342db2119008b8bdf6e24224df44511b8546e1dc8e4db75618a0c3846b31
SSDEEP 384:XFtZcIW8Nf8TUNTUlIlwf5vEUiHji7Uu8Y5+L2k+2S7UnTKwBODNZOCJKDfk:XF1WawgC5vl4C50lS7UnewBKZOOsk
TLSH
T1C1A26D725C68983BADEBAA55F94B32138EB44077D9C46FA4E3EC6F1C00DB598130BC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4dfd7193addb7674b36dc2c6fe2013e12b906fc4877f941431ee0b6a8b199ae8
MD5 59e7b9f4dce0032ac4284db6c49d5746
SHA1 1b655b8d20f1ace41e1b7451d2c72933de7cd31a
SHA512 877b64b4f396c97b4592fd65f18e8d36155f8177e1dca077eba66bd7e5700dc8951c51013655dfd1f062c2f50305f6f287db7a8d712ffc6a41908f9bf7753cba
SSDEEP 384:BZcIK8NFTf5vEUiHji7Uu8Y5+L2k+2DUnTKwBODNZOCJKDfk:JK85vl4C50lDUnewBKZOOsk
TLSH
T163926C715C386C379DA7A155F84B36139FB85067EAC42F6496ED6F1C01EA698230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f042412faf104c580366c70ff5f510216fba9525a05bc2b3547800b6764a9762
MD5 bbf621d0aae04dc294cd88dbfc77b870
SHA1 7362cf2965df9a070330589f0bfb23c927dc63cd
SHA512 2a53ef3cb301a5cf1991ddeb62586f6143ac2e78abcbed913a1dc80435755ff276ba9d8ec1e39bff32ef32bf6ad1a8e35c6ab284aa8ec13e91cc1ce08f9c636a
SSDEEP 192:XGNZ6jCQmiUytPItqf4SufoPxzYlX+OlSnyFpU6:XGNZ6qAPyqfju8Y5+VipU6
TLSH
T14A02E735AC68687B9EA36E55F98B37139FA4202BE9852F44C6F81F0C00D764C2342836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1c04ccbc2eca6240bce7cd398b842f01bd1a237f19174dd4326f94a6c87c37c
MD5 42912d0e38c9627e29d8d1ff2e772711
SHA1 217ceb419ba86b3742cd1e7814c3cba49f54c01a
SHA512 734bb0f2a7a3456205dffc6234cf5569cca14874cf696beb6c77fd0f9f3080830fdc56f500813bfbed0baf2a8d04c6aa1dfc65cc3e80685e2ac21be1f27069d8
SSDEEP 192:VGNUZ6joQmiUyt8tqZ4SufoPxzYlX+O4/+k+2vOMsqGU6:VGNg6kAeqZju8Y5+L2k+2nUU6
TLSH
T10F120A71A818BC379DE3A5A1F48736139FA51127DE896F40D1FC2F1C01EF99C634A862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1292d0ab5db05ef1dba08f3799ef4ba65526e0734afcf1e853efe4be11af2be6
MD5 e4977f15e9d066c058b7a89c183a32a8
SHA1 3a296d5690e20b2add752c2644a296c9554e0303
SHA512 6b97129bbdc0530fc923a930858e3f86a826894994ad42496f4d50758c32ead96768a55a0e29da0cbd71a302218719a95f29dae6b79c5d77bb86049dedd8ee72
SSDEEP 384:fZcIK8NFwf5vEUiHji7Uu8Y5+L2k+2DUnTKwBODNZOCJKDfk:3KZ5vl4C50lDUnewBKZOOsk
TLSH
T1EC926D715C386C379DE7A155F84B32139FB85067EAC42F6496FD6F1D01EAA98230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download