0ba12ea6dd6710b0c3b0b06614e613c31c21fee9880c71acc924dbc374d6f2d0

Analysis

user interaction
yes
max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 21:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zinc-1.21.4.jar
Size 662KB
Sample260511-z52epaev2m
SHA256 0ba12ea6dd6710b0c3b0b06614e613c31c21fee9880c71acc924dbc374d6f2d0
MD5 6d445a8af070e95b53259aef9ada2845
SHA1 da2cc0a74bd0e80046cac7c5dc006f9175665046
SHA512 b26df1cdd7bb654925f8a37523b98f74125c6822bf7b54cfaa7b711b4d103da05ad691a3d2ee6eacbac8a677158fc99765276e10131cecbcc511a8c58c648ac8
SSDEEP 12288:gdO2aimQh6W3m+4esJzl27nZb8lRImAaaKk8Y/O6Ca0IeJygubzwJva/n/BvXuLZ:gAH7vNkB8YZKA/05Iektbia/n568W6eN
TLSH
T12AE402173EF4913ED92BE870B4A1C142E84C61D9AC5D949F809D58DD28E2CDB87A27CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230079642807889"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{72266FF4-F93F-4232-BF8D-9D142CEC0A1A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 5100	4088	msedge.exe	89
PID 5100 wrote to memory of 3624	5100	msedge.exe	90
PID 5100 wrote to memory of 2136	5100	msedge.exe	91
PID 5100 wrote to memory of 2556	5100	msedge.exe	92
PID 5100 wrote to memory of 2556	5100	msedge.exe	92
PID 5100 wrote to memory of 2556	5100	msedge.exe	92
PID 5100 wrote to memory of 3576	5100	msedge.exe	93
PID 5100 wrote to memory of 3576	5100	msedge.exe	93
PID 5100 wrote to memory of 3108	5100	msedge.exe	94
PID 5100 wrote to memory of 3108	5100	msedge.exe	94
PID 5100 wrote to memory of 3108	5100	msedge.exe	94
PID 5100 wrote to memory of 3984	5100	msedge.exe	95
PID 5100 wrote to memory of 3984	5100	msedge.exe	95
PID 5100 wrote to memory of 3984	5100	msedge.exe	95
PID 5100 wrote to memory of 1936	5100	msedge.exe	96
PID 5100 wrote to memory of 1936	5100	msedge.exe	96
PID 5100 wrote to memory of 1936	5100	msedge.exe	96
PID 5100 wrote to memory of 636	5100	msedge.exe	97
PID 5100 wrote to memory of 636	5100	msedge.exe	97
PID 5100 wrote to memory of 636	5100	msedge.exe	97
PID 5100 wrote to memory of 1036	5100	msedge.exe	99
PID 5100 wrote to memory of 1036	5100	msedge.exe	99
PID 5100 wrote to memory of 1036	5100	msedge.exe	99
PID 5100 wrote to memory of 1204	5100	msedge.exe	102
PID 5100 wrote to memory of 1204	5100	msedge.exe	102
PID 5100 wrote to memory of 4908	5100	msedge.exe	103
PID 5100 wrote to memory of 4908	5100	msedge.exe	103
PID 5100 wrote to memory of 1096	5100	msedge.exe	106
PID 5100 wrote to memory of 4168	5100	msedge.exe	107
PID 5100 wrote to memory of 1096	5100	msedge.exe	106
PID 5100 wrote to memory of 4168	5100	msedge.exe	107
PID 5100 wrote to memory of 4028	5100	msedge.exe	109
PID 5100 wrote to memory of 3648	5100	msedge.exe	110
PID 5100 wrote to memory of 3648	5100	msedge.exe	110
PID 5100 wrote to memory of 1748	5100	msedge.exe	111
PID 5100 wrote to memory of 1748	5100	msedge.exe	111
PID 5100 wrote to memory of 2612	5100	msedge.exe	112
PID 5100 wrote to memory of 2464	5100	msedge.exe	113
PID 5100 wrote to memory of 2612	5100	msedge.exe	112
PID 5100 wrote to memory of 2464	5100	msedge.exe	113

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Zinc-1.21.4.jar
1⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\WatchComplete.mht
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\WatchComplete.mht
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x208,0x278,0x7ffc1224c188,0x7ffc1224c194,0x7ffc1224c1a0
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7828578122000083229,14914249131081253474,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,2067060467797595767,5058781447972687354,262144 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,6387047603890855266,6827445401816889463,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13396526888178907025,14582646835082243442,2097152 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5617639939549006365,3870206814961058224,2097152 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,9303304870491040783,2985442860439806783,2097152 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,1871498124968705127,15249534478311381207,2097152 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,11589003688034851000,15586611276584684866,2097152 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,7320753290595897983,8502716169916029799,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,9422859488654276236,17235300772467258980,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,6649360416981349327,17328681516945386568,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,7761997729399718692,15375433902192250863,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10192973107439568070,12107992045004324604,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10192973107439568070,12107992045004324604,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,4866374087577510093,4556531310534097844,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,8601169245942296472,7531193106321569657,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13286582014353463198,12512660976885478232,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,9714005388039559220,11825379971341938689,524288 --field-trial-handle=2384,i,8469150702405819695,15174310065127192235,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 346ea60a0ae4d17c01949616e7832cf3b359983afcbb7e8912fe8a59321ed461
MD5 203e8ac15dc2fa01607dca121531cbf9
SHA1 6bb9e33e0eaaee142dcc669c175ec6b9508af90e
SHA512 9cbb9572308545c1a11487db03ac7301a81dad98c83fd39ad60fc0ba640dee016818808cbd7f5e840f2b2084982cd60ac725f84529aac2387baa86bafeb505f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
MD5 6152b0c1f75d5d080bcd3802185a9245
SHA1 4f64d728e6f0df535705d56e0e7a69fc1e71917c
SHA512 28c794bb2d2495521df039966b1a9e94a2843c311371b43db2ea79c54226693c48e9527fea13c5656d1ef3768cdbacfe060b82385bc27c6d4a2715b8b656c7da
TLSH
T1C3D0C00C73722C30C4C9CC300858730F2D19C8F28E42436254371A385DC20C045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1d5424e3203c3272db4f9cd9e0161e78bf7ec337d47156675c54f4d3d506d304
MD5 8212224641bfd663af879f2432d08605
SHA1 0a8c1e47a8f5685459133bd46e371a096422b444
SHA512 eb3d78eec2daf44f68dde59f88f997b77e5f4073744be69b8762cc4ec27f95007c3e9c5241c43b52caf353244173e80c0cce66f49b93fb82ff4ebe6c9753be89
TLSH
T1EED0A736B74A7411E66D81315523C31A1B2A84A469974581E22CC64CEBFC1D857C71D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
MD5 e2acf35f85cc51742b6dbfd089a22de7
SHA1 d2f831a4d2d2a72bc82294e0db4496d425f3c241
SHA512 dc7c313b6984de31fba866906b65c34a375452af96f5f8d900080a50233e15566612618b446d95b3283af79511b9492a004b9a8f220a70ac98cbe8ba536fdac4
TLSH
T1A8D0C00CB3322C30C0C9CC300859730F2D19C8F28E42036154371A386DC108045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a29ba2f1b2ed295febf05bb24f064e0a8197d23ff3fad04ac6c9c48a7f5e9755
MD5 728ffc35ce899dc5544f876396ffbdd7
SHA1 f33751607d5734b8b6a8939685d05bbed4f3a3d3
SHA512 f373faaf884391a727113b45b0eecdcda27e65e8a19d4ef083c03daf975b99eafb9bbd6ea53adaac00ffea99e04ff2f79ffe4b427f03a030fa863d8a4f3d6117
TLSH
T148610B89C1568528EFE33273ABE5A042F6705F5AC2474F5B35F3F87C9A5AB103043928
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58337f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58337f.TMP
Size 3KB
SHA256 802c5b035d367210da373207f084a39cfa30f99e14777d1ba0535bbb389a26d8
MD5 2487c17b41f35e4ba4a44422e7eabbd9
SHA1 73dbfcdf9f112a59397e60986def0df7764e56ee
SHA512 4b3deb73e6d1bf34cdab07a90df0d5d512f9bc25c26a592ed0fe012fd974a497215c2c807f901f2ad88e5a8b9ab7e2e3087f91c6ea299451a829b58355f9c5ad
TLSH
T19A610C89C1568528EFE33273ABE59042F6705F5AC2474F5B35F3F83C9A5AB103083928
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 96a51b957b0b7ed30a63b7879225f1b34bf1f073e14a45f2d39dc5cb0ca3d55b
MD5 91bb3c66bd0e276399b1a186717d298e
SHA1 3fee36289468a2075252843c5732821bf0c6a403
SHA512 7f6046c63fe5364f926fadb246636c6f970330d9e16be9fe9c9a940dae7fc5a77f229b8bbd2453c461291d8acccf78a5d1da43f917512a70d82726129b88a58b
TLSH
T10B2188F7C3E48A6D8A0056F4BB14AE1BCE2D0955431C3D1AC4E4AE1B97E24A5E14069F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ccc1f55be33a7d954afb81f688e4b3a9354488306442e59e60672316fb7a6161
MD5 9798e58c753fad9c00f8715b596efc8c
SHA1 02973cec5fe761f1ca5b8277bbb0c38de2f64195
SHA512 36d16b3fba2796bd2ba808fe2e90626bdaebaa2a2a057d8757aaf636d2eaf9cc5c9dc028a0bc7fa7ec1a316f705bbfd4ff4d4924b236c9be9462c992533f660c
SSDEEP 192:sxZmRGyM//K1Ml8CJjf/fzsdWpVxxnAIdpdjHW6+WNGYgGoFFTIgyJ:sxZmIN9f/fzsdWvxxnBpHbGJ9O
TLSH
T1AA52D711AA34997BCCDBD30DFA557F53D6F90423A6900E54A9FCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 055038e4c372ada81b930bb5f568c7ced07fff2c36fa2426e1b9bb537da45063
MD5 06cf4c7bf474b9e369399b92c4cb3313
SHA1 a431f87512bee047279925c7b9199665d0b24746
SHA512 f7114832bf95f145db69e35b07617d9e8bde9dc119ff909b5ed32975e5d8738bd77d6b6f9a63c2cf5076c5808a4e2ee7df4b5ff12cf7cce137e90a122af7a083
SSDEEP 768:x6sal4VWvNT6D8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDAwoLl6QF5irofgw9:x6sal4VWvNT6Du1jaWAwoLIs55fgw9
TLSH
T12DE21C3F680CCB7E4F840E5CDC266F9B6DD801CBA6948D5447EA884C03CA6EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 eb67f13e196fba27ae5492104385883401c6ea29483fc552d25e6c41ba71a903
MD5 5819ba6032c81d8eaab3c1e7202d7cd6
SHA1 5799c418d404cd521418da27fe9d62b7368d92c4
SHA512 c6168ebae838b6d259bc96607f1d9f3a36869c6117626bbe25b1c4bf2c6d7c9ccbbdc3ac45f0b22f0f15f215c0a10b5f7baeba3ed170d030041dc35b40787e92
SSDEEP 96:KoleKm8DWpqWkMMOmcHVk2OKc7kIOQe2fYmPF9MHD9X3xmjWskrxKc4kdxQlterh:Ek5f/za
TLSH
T111B10554307B12913A3E298DDAA5B46F52C270637054A96B7FB830650F67E20CDFD8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 974ed632d853fedebb8276da0d1c45c17d284781fb86d132b69c696f8851de54
MD5 d70f9e6870e3e3d594a292167e10a659
SHA1 38b9ea93d12da323e67261f84d1ba5f303d43a23
SHA512 d7abc30ee6c1d20d1a7d49ea3afe240d3c1f4b75c0b37ad2a38bab0a7e7316d041bd2c0e827e97ee46090238c3759e278cefd14bcb54ac36510416c714eaa68e
SSDEEP 192:gONWu6QaQmiUyC8wZ/eOQFX5RHRxMRp2U6:gONWu6v4wZ/eOwroj2U6
TLSH
T11702E83578782C7B8EF2AE09F48727175FE4106BE9966F84DAD81F1D00D7A9C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 062fdd2bc3d58e306e19cfbcddc4d29aef2a293bb09d98e0a329da6a1e8cddb2
MD5 909ad433b87eb7c9d47bdabce760965c
SHA1 2b24df619264097743e7fc9b4f00ccd27c875bd1
SHA512 7d3e91361673299c8efc99a2bf786a3705b8d3f4a625d8bba882cbaa1dd9bfbffec9d9d0d6036c1c9baaed63b7c2b6a02ad9cda56e5224a5a600c0782ac68930
SSDEEP 768:/cpZK0uB41ommOpaTJh828KuqO+ZI8p0Q:+ZK0uBW8f8KuqtZI8p0Q
TLSH
T1DEB25AB0D8A91DF785E1E9C8E907E5132DE4503B89895D1CEAF97A3E31DF5F82306422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ca5a28ac09def3b250acda24380255ff8887e45e81bb4a069fde52f35d0d058
MD5 5b54c83b91634326c1583cf47b389900
SHA1 704b4602e80f215a7c5797f7760e020ec0941313
SHA512 43ba6c9a674c51d1cbad69586780cce726c4baac4308e48a11c857e8611021b48134fa5c9a0f828d57b6bf40481b0409cc955f4799c6f0b193208e6143408136
SSDEEP 192:bOND6QgQmiUy48jZ/eOQFX5RkhF62Rtnaq+aU6:bOND69yjZ/eOwgP62XWaU6
TLSH
T104120A3668785C7B5EF2A544F48736139EE4417BEE4A6F90D5DC2F0C01EBA9C234A836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

d7ac9521-9318-4561-b73c-9a62333fcbfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d7ac9521-9318-4561-b73c-9a62333fcbfa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f008ac469211269177a4f918d52a4b2bb5b5d5e35fd7d3198e89e1f52e19063c
MD5 d10f370c029388b12715a213af04c0d4
SHA1 466cf5fcaf56449674cee4fc3f34d55693d18cff
SHA512 d49488797e18d1fc02ffff565c981660b96925ec0a452c7195914e42e80541bc9c7ca0020224cd0e1d4e2d0e5a2d7dd97781ce0e8b3444e95de3a20ea79ae401
TLSH
T1EF41E559B6F91158B7B36E5AAFF2A86E447F78772F06C45D00110E4F0A22A40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

546cfd22-f029-4808-b9f6-d34283795f85.tmp

Path C:\Users\Admin\AppData\Local\Temp\546cfd22-f029-4808-b9f6-d34283795f85.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c78e7ab7-3614-4bd1-80d4-37c75ac08f81.tmp

Path C:\Users\Admin\AppData\Local\Temp\c78e7ab7-3614-4bd1-80d4-37c75ac08f81.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63788ec5-85c8-40e1-aadf-76fed194e75b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5100_1917747540\63788ec5-85c8-40e1-aadf-76fed194e75b.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5100_967683682\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3368-48-0x000001D75FE00000-0x000001D75FFA1000-memory.dmp

Download

memory/3764-11-0x000001E659F10000-0x000001E659F11000-memory.dmp

Download

memory/3764-12-0x000001E659E90000-0x000001E659EFB000-memory.dmp

Download

memory/3764-13-0x000001E65B760000-0x000001E65B9D0000-memory.dmp

Download

memory/3764-2-0x000001E65B760000-0x000001E65B9D0000-memory.dmp

Download

memory/4028-405-0x00000200220A0000-0x000002002210B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads