darkcomet | hxxps://dosya[.]co/iycbpd2789g4/Vir%C3%BCss%C3%BCz[.]gta6[.]bat[.]html

Analysis

user interaction
yes
max time kernel
44s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/09/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/iycbpd2789g4/Vir%C3%BCss%C3%BCz.gta6.bat.html
Sample260914-ry7dcsdq8s

Score

10^/10

sazan discovery darkcomet persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

s2mle120les.duckdns.org:2000

Mutex

DC_MUTEX-B8VLHHZ

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
JSgtZ8nTQwAX
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Virüssüz.gta6.bat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
177	5348	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Virüssüz.gta6.bat

Executes dropped EXE 3 IoCs

pid	Process
5568	Virüssüz.gta6.bat
5204	msdcsc.exe
5772	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	Virüssüz.gta6.bat
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b00000002385e-318.dat	upx
behavioral1/memory/5568-880-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/5204-948-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/5772-950-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/5568-951-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Virüssüz.gta6.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5348	msedge.exe
5248	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134338702435641517"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{5160C562-A1DF-4BA8-B815-AA2F00D02DE1}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Virüssüz.gta6.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{DA48D047-FC69-4DAC-9A35-C5C161F7C827}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5568	Virüssüz.gta6.bat
Token: SeSecurityPrivilege	5568	Virüssüz.gta6.bat
Token: SeTakeOwnershipPrivilege	5568	Virüssüz.gta6.bat
Token: SeLoadDriverPrivilege	5568	Virüssüz.gta6.bat
Token: SeSystemProfilePrivilege	5568	Virüssüz.gta6.bat
Token: SeSystemtimePrivilege	5568	Virüssüz.gta6.bat
Token: SeProfSingleProcessPrivilege	5568	Virüssüz.gta6.bat
Token: SeIncBasePriorityPrivilege	5568	Virüssüz.gta6.bat
Token: SeCreatePagefilePrivilege	5568	Virüssüz.gta6.bat
Token: SeBackupPrivilege	5568	Virüssüz.gta6.bat
Token: SeRestorePrivilege	5568	Virüssüz.gta6.bat
Token: SeShutdownPrivilege	5568	Virüssüz.gta6.bat
Token: SeDebugPrivilege	5568	Virüssüz.gta6.bat
Token: SeSystemEnvironmentPrivilege	5568	Virüssüz.gta6.bat
Token: SeChangeNotifyPrivilege	5568	Virüssüz.gta6.bat
Token: SeRemoteShutdownPrivilege	5568	Virüssüz.gta6.bat
Token: SeUndockPrivilege	5568	Virüssüz.gta6.bat
Token: SeManageVolumePrivilege	5568	Virüssüz.gta6.bat
Token: SeImpersonatePrivilege	5568	Virüssüz.gta6.bat
Token: SeCreateGlobalPrivilege	5568	Virüssüz.gta6.bat
Token: 33	5568	Virüssüz.gta6.bat
Token: 34	5568	Virüssüz.gta6.bat
Token: 35	5568	Virüssüz.gta6.bat
Token: 36	5568	Virüssüz.gta6.bat
Token: SeIncreaseQuotaPrivilege	5204	msdcsc.exe
Token: SeSecurityPrivilege	5204	msdcsc.exe
Token: SeTakeOwnershipPrivilege	5204	msdcsc.exe
Token: SeLoadDriverPrivilege	5204	msdcsc.exe
Token: SeSystemProfilePrivilege	5204	msdcsc.exe
Token: SeSystemtimePrivilege	5204	msdcsc.exe
Token: SeProfSingleProcessPrivilege	5204	msdcsc.exe
Token: SeIncBasePriorityPrivilege	5204	msdcsc.exe
Token: SeCreatePagefilePrivilege	5204	msdcsc.exe
Token: SeBackupPrivilege	5204	msdcsc.exe
Token: SeRestorePrivilege	5204	msdcsc.exe
Token: SeShutdownPrivilege	5204	msdcsc.exe
Token: SeDebugPrivilege	5204	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	5204	msdcsc.exe
Token: SeChangeNotifyPrivilege	5204	msdcsc.exe
Token: SeRemoteShutdownPrivilege	5204	msdcsc.exe
Token: SeUndockPrivilege	5204	msdcsc.exe
Token: SeManageVolumePrivilege	5204	msdcsc.exe
Token: SeImpersonatePrivilege	5204	msdcsc.exe
Token: SeCreateGlobalPrivilege	5204	msdcsc.exe
Token: 33	5204	msdcsc.exe
Token: 34	5204	msdcsc.exe
Token: 35	5204	msdcsc.exe
Token: 36	5204	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	5772	msdcsc.exe
Token: SeSecurityPrivilege	5772	msdcsc.exe
Token: SeTakeOwnershipPrivilege	5772	msdcsc.exe
Token: SeLoadDriverPrivilege	5772	msdcsc.exe
Token: SeSystemProfilePrivilege	5772	msdcsc.exe
Token: SeSystemtimePrivilege	5772	msdcsc.exe
Token: SeProfSingleProcessPrivilege	5772	msdcsc.exe
Token: SeIncBasePriorityPrivilege	5772	msdcsc.exe
Token: SeCreatePagefilePrivilege	5772	msdcsc.exe
Token: SeBackupPrivilege	5772	msdcsc.exe
Token: SeRestorePrivilege	5772	msdcsc.exe
Token: SeShutdownPrivilege	5772	msdcsc.exe
Token: SeDebugPrivilege	5772	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	5772	msdcsc.exe
Token: SeChangeNotifyPrivilege	5772	msdcsc.exe
Token: SeRemoteShutdownPrivilege	5772	msdcsc.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5204	msdcsc.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 5264	5536	msedge.exe	84
PID 5536 wrote to memory of 5100	5536	msedge.exe	85
PID 5536 wrote to memory of 5348	5536	msedge.exe	87
PID 5536 wrote to memory of 5100	5536	msedge.exe	85
PID 5536 wrote to memory of 5100	5536	msedge.exe	85
PID 5536 wrote to memory of 5704	5536	msedge.exe	88
PID 5536 wrote to memory of 5704	5536	msedge.exe	88
PID 5536 wrote to memory of 5044	5536	msedge.exe	89
PID 5536 wrote to memory of 5044	5536	msedge.exe	89
PID 5536 wrote to memory of 5728	5536	msedge.exe	90
PID 5536 wrote to memory of 5044	5536	msedge.exe	89
PID 5536 wrote to memory of 5728	5536	msedge.exe	90
PID 5536 wrote to memory of 5728	5536	msedge.exe	90
PID 5536 wrote to memory of 4416	5536	msedge.exe	96
PID 5536 wrote to memory of 4416	5536	msedge.exe	96
PID 5536 wrote to memory of 4464	5536	msedge.exe	97
PID 5536 wrote to memory of 4464	5536	msedge.exe	97
PID 5536 wrote to memory of 4464	5536	msedge.exe	97
PID 5536 wrote to memory of 2560	5536	msedge.exe	98
PID 5536 wrote to memory of 220	5536	msedge.exe	99
PID 5536 wrote to memory of 2560	5536	msedge.exe	98
PID 5536 wrote to memory of 220	5536	msedge.exe	99
PID 5536 wrote to memory of 5068	5536	msedge.exe	100
PID 5536 wrote to memory of 5068	5536	msedge.exe	100
PID 5536 wrote to memory of 5068	5536	msedge.exe	100
PID 5536 wrote to memory of 5972	5536	msedge.exe	102
PID 5536 wrote to memory of 5768	5536	msedge.exe	105
PID 5536 wrote to memory of 5768	5536	msedge.exe	105
PID 5536 wrote to memory of 5768	5536	msedge.exe	105
PID 5536 wrote to memory of 5500	5536	msedge.exe	106
PID 5536 wrote to memory of 5792	5536	msedge.exe	107
PID 5792 wrote to memory of 2400	5792	msedge.exe	108
PID 5792 wrote to memory of 5248	5792	msedge.exe	109
PID 5792 wrote to memory of 5160	5792	msedge.exe	110
PID 5792 wrote to memory of 5160	5792	msedge.exe	110
PID 5792 wrote to memory of 5160	5792	msedge.exe	110
PID 5792 wrote to memory of 2304	5792	msedge.exe	111
PID 5792 wrote to memory of 2304	5792	msedge.exe	111
PID 5792 wrote to memory of 1532	5792	msedge.exe	114
PID 5792 wrote to memory of 1532	5792	msedge.exe	114
PID 5792 wrote to memory of 5528	5792	msedge.exe	117
PID 5792 wrote to memory of 1012	5792	msedge.exe	118
PID 5792 wrote to memory of 1012	5792	msedge.exe	118
PID 5792 wrote to memory of 6056	5792	msedge.exe	119
PID 5792 wrote to memory of 6056	5792	msedge.exe	119
PID 5792 wrote to memory of 3808	5792	msedge.exe	120
PID 5792 wrote to memory of 3808	5792	msedge.exe	120
PID 5792 wrote to memory of 5824	5792	msedge.exe	121
PID 5792 wrote to memory of 5824	5792	msedge.exe	121
PID 5792 wrote to memory of 6004	5792	msedge.exe	122
PID 5792 wrote to memory of 6004	5792	msedge.exe	122
PID 5792 wrote to memory of 3824	5792	msedge.exe	123
PID 5792 wrote to memory of 3824	5792	msedge.exe	123
PID 5568 wrote to memory of 5204	5568	Virüssüz.gta6.bat	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/iycbpd2789g4/Vir%C3%BCss%C3%BCz.gta6.bat.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffadd57c188,0x7ffadd57c194,0x7ffadd57c1a0
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11766714238725404786,15032512467737941359,262144 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,3459067410966633038,12454710470023876188,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,9591409272506568818,17332057921839838436,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,9139353591995125315,15525744266956310018,2097152 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,9309325665132302341,3369732012295372486,2097152 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,11221936286776829300,17144573920961591181,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5060,i,14661894268077038535,1724018788363654496,2097152 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16052402258713657191,9991575823999564868,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,17820985093901876819,4478063550008995573,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5616,i,2818082463774701359,14358200526301908341,2097152 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,699616967206925806,12711593218064785447,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,699616967206925806,12711593218064785447,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6060,i,11285786917631822370,12524587416548994078,2097152 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,15313658404501864954,6590450624749548924,524288 --field-trial-handle=2256,i,7212183702526794258,3215266337457508746,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffadd57c188,0x7ffadd57c194,0x7ffadd57c1a0
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,4846865545869387909,10180630366163983863,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,5818382924934423329,16616576862024648319,262144 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,15583864241557032663,17038518801341084575,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,2233926594559132286,904046198618206398,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,14681918123331255842,7729580765814905086,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,14681918123331255842,7729580765814905086,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,7643741392188581030,76998380744102627,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,400167301946984864,4822790704662375928,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,13413607089249742148,2667479862882789990,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,8302352920512953741,16468720443722535811,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,15436723538862389102,15902055403728391465,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8946630793458836522,10776800087819582660,524288 --field-trial-handle=2576,i,882260345494326025,3126644358380711159,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5152

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Virüssüz.gta6.bat
1⤵
PID:2312

C:\Users\Admin\Desktop\Virüssüz.gta6.bat
"C:\Users\Admin\Desktop\Virüssüz.gta6.bat"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5204

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 15b36af2befe35fe915a838fe373ddadc995b04c807ecc30b4341d10033a6db1
MD5 092938ca57c95aad4824564030700ed5
SHA1 503fe833f028578d12ad3657fe13fa1f19816e4e
SHA512 02d0ea2b81625af46652104f4f757f01ff62f80f9fa25da516572b1ddb1968b36176ac8e6a8d640ca5e12bd56e534b35750e329e0fea9615e29267e2cc412087
TLSH
T1E1D0C0049DE83FF4F439303E13280100B0884E930B03204042520A444C503D300D4CD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 986f76e23d2a509b126735a8ae49ca5774c3dc740673c97fde0b3666982cb5b9
MD5 76b8aa2810b9fd030bb8dc0d13162eef
SHA1 30510fa6a83d3a91e0e80f53b19c08fb83e0a23a
SHA512 100bcccede5a012b686c0a95cb33a21779434845255263cc2c00d36d7a5038b4caef51a4ec748aeb9588fc4a332f89c5073a0b2a7eec8c7b1579781f09eeb4e3
TLSH
T11AD0C0C4F7C46F74F9561439331C4209B194CF000D072430109703C40C4036300D40C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9c9de74a2a295354225a1d7c8372b2d2a051210bd3485bcbe8ac84e538ecfab3
MD5 3e2e259a1d1ef3af58c0ff9c76ab0b8f
SHA1 dbb071773be8d29d97bf6ca9db86bb916756eb87
SHA512 f14f287452e2e4f314d05035fd31819dd87edb739ea59d12d11a079c230b34d4ba954a3ed4990f903e35ec273840dd9598759960ce6069acaf8d4e6bc5d83535
TLSH
T13BE02BE9CC16AC3B08FD571D50554641EB4113472B80884B3B3DD11E8FF1A36958A86C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 00bbeb031ca712458c40b3f816a488a63f953860c120b9a5822a0ce60800e140
MD5 c6d8cc28e2504f49224a04085b8c2fe3
SHA1 56d18528a72f8643a2d8b5b7952d30101b82dfb1
SHA512 ee1df4b0e8449bc0909e2b822020c607f5e7b7ee90eed18ac9744631c661d18797a16a8721393392e3b483866fdcadb694b9d68ad6bac23289c2ffbca6989de0
SSDEEP 384:2X4953HA7YEFFyA4wQW8b1DrbWYRE1BxLpV:2q53HaDFFc1/bNUB9
TLSH
T14C13B7BD72A22D63FAC7017C8A4F1A78A775E8AED9D301634724F61D4F1A74A0F4E442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ebb34b0bff171d228895e3647de3c8019f915866af5c87bab96be8f470c1ce51
MD5 d5f3d4c4f835e4524c16be787271cb26
SHA1 dcb87d2d1bad321dbb882def68ed3c52efe00ce4
SHA512 9439d9a1fc0f90b0bde386a35730fb8c5a9299f101ba191c4b7de01dc929efd5dd609fb7afddce2a9db4670a607c13a742296d2a13c8045a6ee734e4064aacec
SSDEEP 3072:LXdL/IL/ttCRkmy1fEL/9L/1L/x5NRi+N341qSGik:zdL/IL/TMkmyOL/9L/1L/Xbiw3vSG
TLSH
T10D44C3F71911A01BDBA842F5D2033A3DD277445E3DD1F9EAE2388C952C25B32B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 64c7c54475cda76e1ff492b834fa84f67fb432813a14842de1c2ad0abe3a5f08
MD5 969e6e28b93bd7cdc7f07097a5322e86
SHA1 510ed52475a8e9937235d5be42e75b6f8beda4fe
SHA512 e315dbc0ae29e39d3c3a2beab65ab57ac22868dc94d85223a89075d6bf58fcd66e1f1e3e2e7566067f5b94f907826d3fbb990b240a6f46fb4fe49cd3b33e9dc9
SSDEEP 6144:8ev51lz4Mp5xDVGNBd5pmr3ZeBOtp+1HP:8evXp5xmda3ZeBO+H
TLSH
T181253AFEC7682C82DB6B8770B0E0D9077E712083B699D0D39944C5D897D2B8576E92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 29714bbf7787b3c6b4a5756a7b9394fd1225f271dd48aea7c6769371e72c63b5
MD5 6dd25a53740f836edb531cb3723ee1d0
SHA1 628452a9268706c3047185d07c67f65fb12d5732
SHA512 53707fb2e6d726158b13b5941ce62dc96540f4dfd6635679ac06440dc96b4180bc0f27c8895b128da49a31a17f351f98e2d0fded217a4af53e7f03cd2f8aa65f
SSDEEP 24576:UvwnD6TmIyGsKZ3PeL7AWKaYqTFrrTq+ahuAf95y6x0l9hkGlAY:2wuTmZTObWjTF7zC15yBeXY
TLSH
T1B9868DEDCA785883DD639A30B5F0ED477C7413C3F995D1D28898C18402A7BC4BBAA66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 42fd2c40168fe16ed7d9f4f5495e293646355f4d8bc08405a7a1b688f7e0d019
MD5 7d304281fbaecb466389537057a5b353
SHA1 f964abc6956999a079a301072daec995dcf6592a
SHA512 8204a711dfdb5708965f0dd1e7fa90985eecd3ecc838a491fdc5fa2e2ce43927fe7e5ba13187442090ef2c23c048e67a99732a3217807c9b0167c38b622a5efb
TLSH
T1728182C0B88434FBFB5965F285E72C433A7465CA58832F6630A4D6FD4E563D8A35147C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e27b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e27b.TMP
Size 3KB
SHA256 dcc20e660fe677449fb8d7f203e4c675f7a1b51613fe5886de837cf3dbe2abc9
MD5 621a422a97db003f1fbd888e83375bdc
SHA1 22afaa7dff713d7323a9c83033c0500e4eab12b7
SHA512 71b00ce036d561dcbdf2062464f39540d07a79e3a6438bc177b1a7060c27951c9fb4131eb995bf1619f3ee6e380322b2332997de19b838b534c1c65263787362
TLSH
T1DF6185D4BC8074F7F79A56F291D528873E34758458872EB23094E5FE4D467D8A35007C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 8e53d643a0a3a51b3ff3d98bdc7c7f413254498ade780c7230b39a9057bbd6a2
MD5 45aab73b8fa8f2aebb391396d219d6d6
SHA1 b772834ede4e9bdebe1c60087ed06a9cf09c13f2
SHA512 bf8c83a8f777d1a27fe37064227bd3b86a65ffb7d02beb322fa53b6f2f3ed2290f6883a60540e0427370a42677f5fa45ab0f481ee117061a93e2c058a2a08dd8
TLSH
T189E0D89868C6C56D55E035C742346F088190359BDBC9EE831F488CC0760A012F2A6646
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 d200649969679ede56817c9dfc75a9c78df0b2efc03a804e02f49985c856a1a8
MD5 1028096003b25dd0c3a6f917086b9376
SHA1 94195b105fec7db8c48a548f5faf69cae8cee740
SHA512 2a206a443bb615bb87d90416530f0aefe26b4eb34221264d4245e9f19476edd20f6430ea6302a824c979afd7af93dad875091b79e1ed9c2c3de9859d89564e8a
TLSH
T129E0869C16C9C53991A57A9782787B0D97E1355FEBCCBE021B4A9D40B10A645F3E7280
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 fa24f8c83546da5313cc53e99b64078f97f410f3143d15e73e6a50c151edd025
MD5 6a6b745be5248e3102deb5f430e3ea9e
SHA1 ab29fa59f45f628eb884ab068c7b56140e751122
SHA512 fecfba8db76aee4c98d076fa89dd373648e96c63982dbc254ccc92525c8c59e3ee0960f0a1afb79306d662fe9e8149a92b3c8a1fd45c29beb35354b16dc67ea3
SSDEEP 48:uzBmw6QU1PzjMr80DJrxiwWRwomdgHd/zIuATFnL81JQ/g5/8OPw521F9:6BCxe1+wwwomw/zIuGLmy/g51PO21
TLSH
T16092F6439E383C53EF952DBF360E10F1CABB91686FA29D5C346558258EBC442F03467A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 90d4f5252c3f3d84a42c15a7f018aeb713dac2f5ce1e589b2ea25a53894f3de2
MD5 e02ee03a9742a0d839b615ee573be17d
SHA1 a6454b061a9c74ecec067763d9d385004cd8c6a5
SHA512 6a282eacf3e90c22f7f7be300a40d4e5a3016c5787662a7202b404dc52dcabf0eca12817e8f5c9962f7464e6d7db3c2d4cfc92de1948afa328270086bd6bac8a
SSDEEP 96:nENwIU+bGz83uy3+u4tgp4DLjGQLBze9z3ljBHMsDEuspU0wbtqrOQpPfR4J+MCT:nE2f+G83uy3Ct7XBBKbH7DXspU3iV
TLSH
T1AB14315F4F243721CDBD917629E744E35DACF03FCB1266CA68611475CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 947B
SHA256 20ca3179ad8a3ec8279e7061bda88e508c7971ce8f66b61bae97ea684de0f066
MD5 59356488d3aab9c7486a9cfb8520e5c4
SHA1 434ae5a3ad395ed3bd8c80e58d05dd9471048d39
SHA512 d6f16ff73dac98c47fb04e88b89e5aab798ab7fd446d3017c132abf7bcb915141a6cbdb5bb5a114db559c3a3afde17ee4668e8e5f9bf15ef1e456fa37c9db72f
TLSH
T1A211A5F3E0515845EBA14FFD77817AEDE757485C2CD5F2AEC51194280B950B0B2C2471
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 2a01d7428d7cebf3bf46204d8b00935508f5a5e3c2d3e7b47ee93955d15e7692
MD5 93142c458d6708bd87e7dfab94f42890
SHA1 536314a98e79ce76f9f09c4a99a5b798c60ae9fa
SHA512 12dfedfa71de631099a8cc3d340d958f7ce11f41ccfbee7753fa590d0a0a7b4b9aa5b8cbac334f6f2bd40886cf0dfbb9432721fdd9c3b8aa3f22137bfac54609
TLSH
T1D2E0DFA456CDC17A6394714B82AC7B0CE3F0362FE7CCAF425B09A941B04E104B2C62C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 f51efb79db635f5836a385747b67f5127ccc7beba18d673758c6c67f1ae4afc9
MD5 0a5543fcd62bb93eab9ba9f2afeee834
SHA1 12da8b11c3201d5c00b7f400269ac756a8d88a0e
SHA512 07b70256b5932c56b20f19fedc1286be6ec9f175b38c6ed627d053d0a0b3a8830739a7f42ddd089bf432417446ab6c04bc8fee6e100212ea0bf16257d789e28f
SSDEEP 96:deMatUaAKrMFcqTAZJawLHTbeY6tk6oYZ7xKc8:dLaSaHrMFcqTsLzhYZQ3
TLSH
T11F921A5E1B302120C0B94D7AC8D094276DBD001B9723793EEA4920F2EE26996FD166BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 f8b377378f957ddee9771bc4707078934a5f07a6934ac1652e5e1aab1622846f
MD5 23bd744e666d432cbd342b8217e353c6
SHA1 7cd2387c64a27135590b30ad1dbff63e68ca9b67
SHA512 675d2ac7fb2bfb7facb1386a17401675aad0c582131c53d26216625f4fee0e2c10976ae0f6b9ed664490486e96c75c9e8cbb2de231ff5f753c2a3b79a9dfe6f8
SSDEEP 192:D1XVW+C9JthGrgJKeZpcyJ3JXwaejwMHDKM5OMVDars2ePLXGQhCKkAC7bP61VGz:D1XVW+CLthGrsKeZpcyJ3JXwaejwMHD4
TLSH
T111229CF3C3F8826EC85152F4AA247E2EDD2A0A19426C3D5AC9D4AE8FD3E1470E151D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 b261558b72dda10f0c0138de226c4b358d3d7afb599ac7af4ca02b8b0da94ddd
MD5 bc3f1128fcaa959687b1467c144564a4
SHA1 fa774656d0aaea0eb988f6c37a9362316821c14c
SHA512 85a3c6af6f514f8410283fe3cbe5021a04ba5fa2d174489701dd61609559e71ec9bdc5dcfa7fbb3fc18b91b1a708e21f95e41ced6d5ddbd78a81bb663fe06af6
SSDEEP 192:uIEumQv8m1ccnvS6DOkfWu6AZOzHQ1sccugp9KcM:HpXNuuIzQPcNHK/
TLSH
T1E1F2F1F716369146D96085F4E0046F4EFF13000752FAB6EDA2911BF3E2D50E2A1B9E9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 8a72fa8ffa4caaec85982f7b715a20d8f1d8d08c7cda1e2b00dda82c748cebac
MD5 ec124ceb964fa33a3c5e331965f1f615
SHA1 a185ca9d87644e0736a21bb2cfa7f62941858532
SHA512 ce8cab5e0fd676bb512f1d254f99fb73994cc28066a959ed81d6c6e1aabbe355e5f47e0078dba937d3851a59fd5f32eb7e339126e8a7ddedff007634b1fc60c5
TLSH
T14D2149B395BEE83700790D770D45B8056BB9AC34099264F8EB66A12C70D08F72B1686A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 13b20653386dea304ad72270a3fb237e18c41acf674e858b2078092394757843
MD5 feefd58259e3afa5e32440f381a0814b
SHA1 8fd81b61e5e7bc900780c36c609f16ca858e766f
SHA512 838023450f507d4b89791245b367fcf01c42013163329c7693544903ccfb0ecefd78e1250da5b982e0edc75db14d32a820bbdd94db6f1bc6e7a5cc8a153ffa0e
SSDEEP 192:sxZpRyLUe/fjs61WpVRQZZSZzodp7lRHW6+WNftgXXY7IwFYY9IgbPl0J:sxZpDe/fjswWvROZSS/HbaXJ+YOLl4
TLSH
T1A852B655AD28A93B8CD7D21EFA557F63D7FD1032A0915E48AAFC8A2C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5294db60dcc8b4a833eaf8f9db1cf343af43409c04813b212848b10158638740
MD5 94e88cfb27b934d9b3708f590c7e22a0
SHA1 345e77d6e84818c5ea14a6b2c04a4159d1f70b8e
SHA512 d6337103e3d49a63ff25359b2921e159f811c28166aa21e895d7a8fa0a242eedab02b4e5ce42c0ed3aedcfa66cb5dba91e981accfc086a510442604543ece6df
SSDEEP 192:sxZpRyTUe/fjsCQQZZJZzodp7lRHW6+WNI0a/YbIeFYdjIgSl0J:sxZpFe/fjsXOZJS/HbG/FUYZSl4
TLSH
T1B142B755AE28A93B8CC7D219FB59BF53D7F95032A0945E48AAFCCA1C14E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7a7ada9334c41528a39d11fb59db509223b11175aa5c4ea6692991bb398c595a
MD5 2531f03a10707391aeb638543e979bbb
SHA1 31801d4ac76ecd7e9284b883d2c2da5dfa815282
SHA512 dafd62f1b8e2cc03927b372e60a3138e796a1656ce4611fc448e7dac6377c42b5bc120508223d76a86f3b166126e5bf88c61c7340ab0c4560f191fa8e482bb0b
SSDEEP 192:sxZpRyLUe/fjsfWpVPpZWSZzodp7lRHW6+WNftgXXY7IwFYyjIgbPl0J:sxZpDe/fjsfWvPnWSS/HbaXJ+YeLl4
TLSH
T1C552B756AE24A93B8CD7D21AFB557F63D7FD103250911E44AAFC8A2C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 df94bfe256fd8f25b7454366fe45822e51a5f3e23c72fd6ddf619c552c3712ed
MD5 93fb8e33e04474249e8a7f48bb230823
SHA1 ae2ff8d6d410e1ff376d5aaa5b7ac728265c85c4
SHA512 502031a15ed56af0b5372c502ee206517a221a7a7d9324aa1d3ba22bcd2b63116682f301cb3bceb92c929efff71d88b0d7d68193703033c3dbd7955d1a905b05
TLSH
T1D9E020541EC4D17DA0B631870664AB0892F4752FF3CC7E411F42DC40724B504F1D6140
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 cc443024046944eccc8237b4a7aa646354277ef0c60fa1f84df20861327a8655
MD5 139709225a8dd9b0d847cb233234855c
SHA1 828b724c86236bce2519cdea1bbcd6114514308d
SHA512 7fced284b7eca7c94bb937bc7fbe69c36b1052b50431c26ba3c1a4e94f696e45d6c64c36cfde4147e4ba11c93290c37f1a1a8c28fb7a0646e2d7d5e1d799fcb3
TLSH
T146B01254BB108337F1C56D3C09A5CF51E250F01231400AA3DDB45F500E09B68BE01DA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4e73f6990f51238da4078e9203439f400e3e1296f13e83d7a9a961ac01603e43
MD5 30acb72271781e70f6ff16ce1417f3dd
SHA1 5c9082fa758731b3b60d8fa123047a865dddb620
SHA512 ae8d347cd6608e2e7154788f8c95cd0addcde074122a05b856e211469929e695d30bff178543f1c0ecef235de00ad17a639e341ad79e859e940c3de4c276b966
TLSH
T1B2E0D8247AC9C67B61FA31C7623DF70991B3752BD7CCAA517B09B840730A18072C3540
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 835bf2ced3f1da6eba20e2677b2ab4b38e7bbb3f147e4795919378de378a2dde
MD5 4a5b08749692e3f037dcd1bf19021f58
SHA1 6ade81772c32e4adf7759eebcb22527dd1e22973
SHA512 c785c9c8f913359a01ba52f3872306a01d898e0200faa5da5a447aada3e61688d088b1e618e7a29f5b6e7eda3b713bf70a42c7d2a7b033f2af02c192b5cc5464
TLSH
T101E086B456C9C63951B571C75274BF0D93F07A2F97CCBB46A708A442B106145F2E6AC0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2ff82e1954c0673fc3b7a3ec4a73c5e5648e94ac2814b4ade19dc8d69441bc4a
MD5 ab6f44ed66775bf25aac8849236a4a1b
SHA1 f06d4ddd5a0284731e43b4ad22d8123430900ef6
SHA512 9529450704aca75cce8be1be375800a93c6706179d16dcd1b5f16b02bf8d1331c6e7570a8078fd6507c9569d679f91aaf651d6e4f0b3879eb71399aac7e9d7f7
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXO13A:OtfFvpopPxrB4RhfOVA
TLSH
T1DEB2231571BB021138FE690881B6972F064232B37158E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 327e07922ce8beb6b431a50cc93b45d9ec1911f6bb06602b4d9f8d4df9248040
MD5 66f5a602d0b9f64f783b7d42fcefa96e
SHA1 73ef86de931287809aaa140f9ea4f72c745899b4
SHA512 2c60396d106cbfa40b0e42379884caa4e520de08f248e15f3c04ef1451969b653f3ea142ae442b08e96cb436fbf48f6226948a94c1adc4a3356ad0a52283d40d
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXO13wd/77g:OtfFvpopPxrB4RhfOVwl7k
TLSH
T103C2585571BB021038FE290881B6971F064232B37158EA3B7FBD54A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 c780ddd744ea67adf02fc0984281bc6bbf5a05ed6e9aacc554c97ae30119bd04
MD5 1838a375ae051d6e0bb19d7bdaaf4655
SHA1 ecebdb5520a266d512076d1d41a0458012dde518
SHA512 582017987039e1b8a069b4446cd7828de0e16a772b549a2fb083386531aa7c16cb3483840f147d8750460758b1013a749f6bc26de54711024a2f9936cfe8af3f
SSDEEP 192:P+xWksfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxwfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T17F24740A7B747001EDE6D9725CB080771E3C716ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 1683dbbf9e7b7cf74422056a1a57dace7c658208b4ef37ce7c37af98bf0b2e65
MD5 bc3c57760e2713ad637dbef6b638de7c
SHA1 6c1267f7916bc9916835b8b172306ac23a04aa75
SHA512 51bfff08ebf123d43b262f16819710bc811de54f355016f1fbef8704f1a8f731587ce6a86a229a5a04c7d640885542fc9ca692c0bafe7d918a97fe85dc741954
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgfEJNy4GEdxGt:DEK3tjkSI5IUltGhp22iSBgayeW
TLSH
T10152FEABBD7C7392CCE9433056C001E5BE7E943D8FC5EB06059610161EF4692A31A7DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8cd1d42-78c0-4ec9-9ad8-99888b8a40d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8cd1d42-78c0-4ec9-9ad8-99888b8a40d4.tmp
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 c5a1ed8a5b0dd28b36fa848d29b89e7bd45f9beaca2694a46bc730118fd39055
MD5 cd71014a3df0efe7c2900e6f38dacb64
SHA1 3dd86ba0aa072af2ca6b48b51d5a09ef498a7445
SHA512 d4255acb5d010998981e49c494225cfe1253b9a33089c7512180d9c5f2a9f8af1d489b39ae650af6ddea5178f075f8ab60a30229da380bc922da4c0f42a85ce6
SSDEEP 192:42ODTAs7lrNUQ2s5WPIBDngQ5IIImFbgMIMa7YcY/bHlb:aDsshR2sw6gQ5IIImFbgMIM6BibHlb
TLSH
T12E72B4BA16191B73C15E2F7B26655B8947D88C418AE3130E3262640F9DF6B6BC3D43F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 84f9c87c0fb2af71b6e5ead56788ac1be53641dd950974e5cd4069243c13eb32
MD5 d960244662e1b5661154f1ad7bebeebe
SHA1 72c6ee117bfeaefe1717c1c9fe5ee71ac1788bb1
SHA512 080cb9102e8dccaf5d55c5c7b0a1b0d7415f5b9eb4c596d82e6008c01d9731b80487350474a0401f87e7e85c25a9de9b9ad30b9eb9e6980b65584b9fbf034070
TLSH
T185E0201475C9C1BF71A4328711286F08D294351FEBDC7E456F45C844B10A50476C61C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e95270795338859cb7dac08e5d81accc1814a9aa45f45d6b848b6285d8fc4ccf
MD5 17cbf99bbc6be452e6b3274030e04cf1
SHA1 535118a6dae1c18e1b0a6c262c489c29bfded53a
SHA512 6562ed025d0bfdfcef1c8e28dc7d53fbf879faeb9fb12335e8b6239ea39a3082ad609668beddd71c0d5fd2ddf13e473e932c61278bc6fd73994cb6c753046c62
TLSH
T1AD21BF56F320C149E14E863DA06BA7351378E8529FFCEC0F45B964356E72A001E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 b40cabef6f96172ff3c7135c3d1f1fb4fbd7a6876ab5e1e6edcc43bfb9040d23
MD5 0123560000d3f39aac3127ca60dc6331
SHA1 5fc238051975e00319192d0a307a2b1b24b03aa8
SHA512 7ef2c565f062bc57efdc05a8c0496aa73700e60ff8f6dd00f58939bf592a70884afd6b37ac887d180397383f025cb000b4724101be2332c275ef765b808d55dc
TLSH
T139E02054B5C4C3FF51A472970178B749D2A1391FEBDCAF415F49CC48B10A54172C61C2
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 25c777ce138add77ef5df08f5deb2d47e02f2f2f54de5b50f6cae7d6e0ebe7ce
MD5 9355091562fd6240906e3ac638c780b4
SHA1 11c9608d6032d37783ce8e805725224a4aaadb0f
SHA512 425ab58fa45add66e9e727bac22b3b622285d568e0630860c61d29b317d340974b8f744ca197cffeff238709fffd8ab2577312d0c285a8e4a4e9badd3b65a373
SSDEEP 3:MsEllllkEthXllkl2zEflUIKl:/M/xT02zb
TLSH
T17A4404047FC00445DD00507050D1C3501370D41005115F437CF544335CC77400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 987ed12c2282aed9075f020e0c87606e84df36f1f73bab5b437b02bbe26112a3
MD5 1a20003f59aa6b86550ca6c9e2b7d372
SHA1 0534a81ea57c03ccf5d27f96b74afdbb0629cad6
SHA512 d08e025b3ef91fbfe295cb27601ee8df94bd1feb2fa134ed769f836c32c54ef72de32133af4e089786c223fed3e85d00bfb768a6dc01d4df50632f42c49e043a
SSDEEP 768:lF4f3cwgSSlBbw4mIHxSOwKwIr+f7TRS3:8f3fKwKwIaf7TRS3
TLSH
T1DCE229B1D895DDE7A8EACAC5664AF506EEE40173848C4A8CD6F8BD3D308F1BD1707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 64da48c3c82c7bdbc1bda0c68588daa5552287194cb99b9d5d84491b8d00f691
MD5 fdf506713c5082d69c0434ad33ebe425
SHA1 98ac9ef1fa1b5231b9aef61c463818737f306602
SHA512 f1c6adf63976ca1a6e9692a144b94b165230c99e3c75407b603df9144a56c193bf2c788af266366fc6385d931d68b76c062479512752558c7ec9a7fe9743b779
SSDEEP 384:nOiF6ZcIhsN58TUNTUlI4+D5mghDgNK2fLBgaw4QRsiUrDvWAShlKzMKwIr+f7O3:lF4hcwgSvlBbw4mIHxSOwKwIr+f7TRS3
TLSH
T1A8E229B1D895DDE7A8EACAC5664AF506EEE40173848C4A8CD6F8BD3D308F1BD1707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b5c48645df994056d6264ecff35206b7ac0b0bb1c5397cd4466ae6d82e68849e
MD5 e007abbda07b74839f71d8d461b45466
SHA1 29999277f12e3b0d6bebf55eda34f60090b0fea5
SHA512 f93a42eab9ed81c9c2e7aaeb98b0c996b1f39ea130ffe14dd67fa8a1711685c67c52e0e6a962773656751558246d44581ae7a8eaf0c8372e338ba2ecdf3d157e
SSDEEP 384:nOiFiZcIo3sN58TUNTUlI4+D5mg91NK2fLBgaw4QRsiZ87O6R2FeobgL/7IzNDoM:lFQo3cwgSYlBbw4m987TRS3
TLSH
T116C25B72E8A8DABBEDEB8AD5A70A7607DEF04163858C5AC0D9D95D1D00CB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 eadaedab41aa9efbd80a521b0f1f2e166e61d8aa82d5e0861ec9e0dfc2b37ee1
MD5 42274228be68872b6923b79a37abd0e9
SHA1 ce382b4a72d01fcd6dd153207ee0210e17dd6a45
SHA512 0ebf56a4ce932dc268ba0ef12608fcec0b8783597ac84e28dbcfaeed763572c7d966f62036b12f43d35b7c0056f39bdf20d7b211fe1f697dadc652c7d7049eab
SSDEEP 384:n7iFiZcI63sNO8TUNTUlImkB5mg5bnK2fLBgaw4QRPtsa+VYrgL/7Izaom:WFQ63XwgBWA3Bbw4mPthgXh
TLSH
T12CC24B36EC98DABBEDEB8FD5AB4A7A07DEF00163849C59C4DAD55D0C008719D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 ce8ffc470c058ef3c55dde20d85bffeb9b1f52fcb00b63413e659a521279662a
MD5 2b3fc2f1a63f82812df85ba904becdf8
SHA1 10cdf9bcd672804a4802160218c7463374621f2e
SHA512 303abc71b23a153f151a5ca3071e7064f2fddf99d9962ef02a58a6c590a47c92528d2db6ece90c3ea2348282c9512b4c79a2c8092161fbc47af444ec0a6678be
SSDEEP 3:MsEllllkEthXllkl2zEflS/:/M/xT02z
TLSH
T1864404047FC0041DDD0110304051C3501370F5300511574734D147335CC77400C40044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 25fa0f8b0d9fdcade017163785fc4901f762866406219e07af0661852362428a
MD5 54b3c006fc066a2b3c8da41e4eb9b3ba
SHA1 6fbb91a3f64cbcaf384649e53ccc4eafc8f40b3a
SHA512 8607ba34ae4f8179a83ad47d663ddf28e4f00fea11aedaf772d6325c894db8d6c97bbffbb2d97c76f4f70c153112c254712ad14c9b6d78d1df3098a2766ecd79
TLSH
T167412868A6FD1158B3B76E5A9BF6A86E587F79372F06D4AD00110E4F0A22B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 52afbd884a54dc0c152d544e557733c2cccea210b504a6f7539f78e57a672fcc
MD5 d68e5543b38f32f9b5d26160785ae01d
SHA1 9f67cc46122bccd1f3a8552b238b79c06726ef52
SHA512 e525bdb62b42f6e38e5ce93e8e137e0dc4b33b789643ba2c750ed0c9a3132b2da1fc3016ad9b00a41525b1fc725751214703637f2c0495501f10185300857b8a
TLSH
T1AC513D5CA6E91048B3737F6AABF6B5BD847FBD332A07D45E10210E4F0666A40C4A1737
MD5 SHA1 SHA512 TLSH

Submit Download

c2491f71-4edd-40a6-a896-0333dc159d97.tmp

Path C:\Users\Admin\AppData\Local\Temp\c2491f71-4edd-40a6-a896-0333dc159d97.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0e45b42-926e-4bfa-8a40-c1c52124452e.tmp

Path C:\Users\Admin\AppData\Local\Temp\f0e45b42-926e-4bfa-8a40-c1c52124452e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5792_1502371422\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfdeb3d4-60ba-4761-9455-eca539dbde69.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5792_37588020\dfdeb3d4-60ba-4761-9455-eca539dbde69.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Virüssüz.gta6.bat.crdownload

Path C:\Users\Admin\Downloads\Virüssüz.gta6.bat.crdownload
Size 251KB
SHA256 2e5708538054bd5a612aca16d10ff1bc97a31799e985088ab4cf4f9af7476c64
MD5 1591252509ca92dcb894e213bb286b0d
SHA1 d6d31ffbf3f451cb6fc959e429a4735d2badce31
SHA512 675d816b64761d0819810d8756b3d182a0f671c506b688d065896c37818b006eb879be2de6af0c54ac30e3a3f96567e1524f826b270db8b3d92ec4889ca6c496
SSDEEP 6144:RcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:RcW7KEZlPzCy37
TLSH
T1324423A57BC59C43EAB9BEFC060D0F145B04339F1EEE82929F25034871A6A8A175773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5204-948-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/5568-880-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/5568-951-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/5772-950-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads