hxxps://github[.]com/ytisf/theZoo?utm_source=chatgpt[.]com

Resubmissions

06/08/2026, 22:49

260806-2rx68acf496

06/08/2026, 22:47

260806-2qhedascla6

06/08/2026, 22:29

260806-2eb38abm8y6

Analysis

user interaction
yes
max time kernel
335s
max time network
332s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ytisf/theZoo?utm_source=chatgpt.com
Sample260806-2rx68acf49

Score

6^/10

adware discovery spyware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	raw.githubusercontent.com
39	camo.githubusercontent.com
40	camo.githubusercontent.com
41	camo.githubusercontent.com
42	camo.githubusercontent.com
43	camo.githubusercontent.com
44	camo.githubusercontent.com
46	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2748	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305301860205778"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0DAF0931-E203-4662-8212-7E368AEA5A3B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\.py	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\్䝽㠀耀\ = "py_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\.py\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\py_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\్䝽㠀耀	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5716	OpenWith.exe
1712	OpenWith.exe
3864	OpenWith.exe
5176	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
5716	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1712	OpenWith.exe
1528	AcroRd32.exe
1528	AcroRd32.exe
1528	AcroRd32.exe
1528	AcroRd32.exe
3864	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe
5176	OpenWith.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4720	4988	msedge.exe	84
PID 4988 wrote to memory of 2748	4988	msedge.exe	85
PID 4988 wrote to memory of 2516	4988	msedge.exe	86
PID 4988 wrote to memory of 2516	4988	msedge.exe	86
PID 4988 wrote to memory of 2516	4988	msedge.exe	86
PID 4988 wrote to memory of 856	4988	msedge.exe	88
PID 4988 wrote to memory of 856	4988	msedge.exe	88
PID 4988 wrote to memory of 6060	4988	msedge.exe	89
PID 4988 wrote to memory of 3724	4988	msedge.exe	90
PID 4988 wrote to memory of 6060	4988	msedge.exe	89
PID 4988 wrote to memory of 6060	4988	msedge.exe	89
PID 4988 wrote to memory of 3724	4988	msedge.exe	90
PID 4988 wrote to memory of 3724	4988	msedge.exe	90
PID 4988 wrote to memory of 3728	4988	msedge.exe	99
PID 4988 wrote to memory of 3728	4988	msedge.exe	99
PID 4988 wrote to memory of 956	4988	msedge.exe	100
PID 4988 wrote to memory of 956	4988	msedge.exe	100
PID 4988 wrote to memory of 4620	4988	msedge.exe	104
PID 4988 wrote to memory of 2300	4988	msedge.exe	116
PID 4988 wrote to memory of 224	4988	msedge.exe	117
PID 4988 wrote to memory of 2300	4988	msedge.exe	116
PID 4988 wrote to memory of 224	4988	msedge.exe	117
PID 4988 wrote to memory of 224	4988	msedge.exe	117
PID 4988 wrote to memory of 1176	4988	msedge.exe	122
PID 4988 wrote to memory of 624	4988	msedge.exe	123
PID 4988 wrote to memory of 5344	4988	msedge.exe	124
PID 4988 wrote to memory of 344	4988	msedge.exe	128
PID 4988 wrote to memory of 344	4988	msedge.exe	128
PID 4988 wrote to memory of 2264	4988	msedge.exe	131
PID 4988 wrote to memory of 2264	4988	msedge.exe	131
PID 4988 wrote to memory of 2264	4988	msedge.exe	131
PID 4988 wrote to memory of 1312	4988	msedge.exe	132
PID 4988 wrote to memory of 5116	4988	msedge.exe	133
PID 4988 wrote to memory of 5868	4988	msedge.exe	136
PID 4988 wrote to memory of 5868	4988	msedge.exe	136
PID 1712 wrote to memory of 1528	1712	OpenWith.exe	140
PID 1528 wrote to memory of 3952	1528	AcroRd32.exe	143
PID 3952 wrote to memory of 5220	3952	RdrCEF.exe	144
PID 3952 wrote to memory of 1680	3952	RdrCEF.exe	145
PID 3952 wrote to memory of 1680	3952	RdrCEF.exe	145
PID 3952 wrote to memory of 3468	3952	RdrCEF.exe	147
PID 3952 wrote to memory of 4912	3952	RdrCEF.exe	148
PID 3952 wrote to memory of 4044	3952	RdrCEF.exe	149
PID 4988 wrote to memory of 3508	4988	msedge.exe	152
PID 4988 wrote to memory of 3508	4988	msedge.exe	152
PID 4988 wrote to memory of 1064	4988	msedge.exe	154
PID 4988 wrote to memory of 1064	4988	msedge.exe	154
PID 5176 wrote to memory of 5388	5176	OpenWith.exe	155

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ytisf/theZoo?utm_source=chatgpt.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff97c22c188,0x7ff97c22c194,0x7ff97c22c1a0
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,17832341696235199674,6319299336195582695,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,1267755802935212035,3655611338933134309,262144 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,16170460115005126989,16117386620544234709,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,10794237422813122400,17047321192856062347,2097152 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,9034205430417570073,16540453732243650538,2097152 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,2989174486854083609,17959743358623530164,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,11387800982644040213,8834143309031959338,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,8526708729891955218,1124357177958892954,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,8526708729891955218,1124357177958892954,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,7038035885182624510,14410188295679833155,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6200,i,3128652435533107700,17261537885456469312,2097152 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,15445019297673068684,15275205552866294665,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3490098989405873776,17693778948562801214,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,15903826236576397700,12449159272947537017,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7724784012888690872,9500982973172718087,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3604,i,14045941186239574753,14676903293948871708,2097152 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,16076117985371445995,12383234199351878687,262144 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3112,i,3481045529957216179,752728130469273922,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,9908207221459131674,13312065163257032754,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1532,i,16890123236536824695,6286580510930752738,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3643630594828154355,10479185979123163903,524288 --field-trial-handle=2344,i,12592206184432485162,7246600666786601022,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\theZoo-master\theZoo-master\conf\maldb.db"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ABA2D3364DF51D615E85A714FA380D6A --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C2A0BAC4429C7537CE0B6152DDF7225C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C2A0BAC4429C7537CE0B6152DDF7225C --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:1680
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B5CE47B80F76F9DEB5226EC2FA7B5F7B --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3468
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=641E2EDF0216D8C40F38F479755944A4 --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A5DE4EEB12A529B4DF435DB42E458473 --mojo-platform-channel-handle=2400 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4044

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\theZoo-master\theZoo-master\requirements.txt
1⤵
PID:1228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\theZoo-master\theZoo-master\theZoo.py
  2⤵
  PID:5388

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\theZoo-master\theZoo-master\theZoo_gui.py
1⤵
PID:5192

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\theZoo-master\theZoo-master\requirements.txt
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 b211b1d8aa9234eb56487502dbb0caab1928289bc842909292e6d1d544efe9b9
MD5 cfde902538077ce0275f118d5c1d0e13
SHA1 30cde6763467bd2e5b4e25603257e4e0205cb719
SHA512 c22eea0eae3ced8b59f3f6a4f18aeda37071ef5b8185803bac34e685a78e5c18a1274ad0680d3c58b8c10e61383c7067d30fc4a58cc127ca2f35abda48caa9ca
SSDEEP 192:nRpjCR+sHsIswdwdwCvwCvwCvwCvwDwDwDwIwIwIw5w5w5wGwGwGwPwEwEwEw1wG:7jiMlssDDDDqqq555IIIPPPG111EEEE+
TLSH
T1CFF1474682D5CBAADF0510CB5DA0A36C90B0B70DEFDCD54C179C8DDA348E49AE6E1AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 48781ae7fe2baa325a477574e9e16288ddc04c7dd3f460708e48c6b90130f9af
MD5 cebaa75b369563d4f5668b59bf6975e7
SHA1 6d7ee540446dccb2abd2b69398f39f94e08a8d32
SHA512 8a4a7499d10bbf22ed003f594637d67271c20258b36bff2e895e352b8c4a3843c0880fcb53a507492dabcd3a5e49013691b7830cd555dd807ed6db1039fa7db2
TLSH
T174E022A6C822EC2718FE0B19A05D8A97E70023573A40996F7A3C910C8FB062A95CA85C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 5d235cc5facd2be891dd5292682f93934dde5cbf6853505e3450c2a1275f9743
MD5 c41e0aad41b4a4bee785d45cb3873e7e
SHA1 b654fd34f630fc3545f92b8d1480e312ce7400d5
SHA512 41ea40fdec8ffe60d4f685981ea4e6dec905aa65527693a997434c368fed6098b60d42b334ccea86d9f2f8c4ea4e7c8af156f1ebeaee29b6f1eccae796b65d1d
SSDEEP 96:9f7KBFx2O/DvkOltUc7XPsxwruE/9oNokNNer:lKBLxLFRPs+qE/WNtTA
TLSH
T19EC1BF7DD94A46AED70D20B168C305487A3EB6CCFA535FC34292F5346A0ABF5A087344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f596.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f596.TMP
Size 3KB
SHA256 ce577e580b24229ec778576c88e5acac283be51bac6d1bb325785112bc5d058b
MD5 5da22f66604082f4506f34f32d2e399f
SHA1 152cd1dc93906460a608f3905717355e1575afc4
SHA512 ced9820712641c91b138a1907131ddc058611676214a15f0d9aada8f92e8dfddc7ab894c5276584928a891cf38da983f41899d220357a9fff00f6a4baee6c1b9
TLSH
T13A61E73E8D0F02AFE31961B169D10648373EDAC4FD936F860192F5342E09BD1F0E6654
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6b4e8650a6799ecf7dd95495887bfdd88454e2667dcf8c3f3b6f18576668d580
MD5 20ebcb14d862f6174552c11c1a0e782c
SHA1 518d152ffd83fa8b3cabfa718a9c3222a1e522fb
SHA512 d9ce5f63e4d8e5f7f26a5d0b45a1669b0d66c37997ec626745237dc997ceb220767a083ddd7570548e76d1362678eefe7fb75c6865f648d17d6b8e71c0eef019
TLSH
T1295178F747B1956D9A1295F0AA08EE1FCE6C0510831C78AA85E07E57E3E3871E14275F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 48ce0f349bf7f4ac72bcf7743436374df3134e00f5729e03ad2f55d83092d763
MD5 5ad9d275af75066b53900a0ae0164f6d
SHA1 4ec8ab6362e351883f2c8c3d1c1846ce30ebf179
SHA512 5bd1e7f3ad1e44cf11d5b5fe4835587992f8deda23fe0aa0583a03a972b5d93b09894f787982c392fba40289c27418fc59b96ee4a70980c9007e0ae117c19262
SSDEEP 192:sxZGRp/yMqZjK1Ml8MkE/fyssvQaZd9zodpvM2HW6+WNY5J/YvNuPejEIgjHJ:sxZGWME/fyssvQazWjHbk/q8jp
TLSH
T15272E9566A34597B8DDBD219FA55BB93D3F90023E1944E489AFC9A1C00E6AEC320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2a06a8219823d98a61e749e21c113c2c50b430ac89f1f36c9854adf32487ca29
MD5 0d2c01b38e2bf16c6ee500043b0beec0
SHA1 d804b383870f437f1ef1630b433307c50260b7ee
SHA512 8428cca8e752ef2228a355f27b099198bc3b05ee329a259a3027638e12d1f252a8e994e6617e2cb2729df86555334506f7b45c891f01804b9f5506eeb32d6bc0
SSDEEP 192:sxZGRp/yMqZjK1Ml8UQG9E/fyseOZd9zodpvM2HW6+WNYtlhudYvPaPsjEIg5yHJ:sxZGWqAE/fyseOzWjHbzdQ8Ep
TLSH
T12772F9566A34597BCDDBD219FA55BB93D2F90023A1944E48A9FC9A1C00E7BEC320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 e4588c67b5de8cbd1b05e75b0c616414c7504e6d1d6b01e17fb1294e6f654223
MD5 1a97bdc975cb006987089c240917feff
SHA1 63958d89a9d6e2b0d8f30fbdc7195aa62fe5c86e
SHA512 e48642beddaf5fce6ef445a761de75ad73c5b14a6b3e490f9a21749e3055ec59aaba849924e439dab7e0f4b8c6d43905d4226b2b6c4b08dbd6b650c6b6efbcf4
TLSH
T18F51848E4E12CA6ED99441B204B260D037B4D8CD2B55961748FC2636AC5361E294F699
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d2d7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe5d2d7b.TMP
Size 2KB
SHA256 f28c5eef603dac3cc04dd2a8e9f096f97abe5e1d7adb38eab4f93154e24b80f7
MD5 aad9df7aa2d7a2371e1c944239be9377
SHA1 e1aea9c9839d4f1989d85b9fb554ad274cc710e8
SHA512 f002ee9f0351ff6b09b55413db8a798d3d9d19bb326171b14833d8b9acb1ad2109d720a6bfc278755fcac0341dc1c6defb2d909a40d40f8c4e5a78976ce26e3a
TLSH
T14B51B68E4D42863EDDD440B309D364A4333AA80096167F4374FC9636ACD23AD3E0E3D5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dc93c0c21db238990e9ebe52b9d5b89ad701c5025fed4ac24a2f69e6b426bcd2
MD5 fe67b529947b6e90a09dc435b9d2d8f5
SHA1 348335519b22f7a57960a9fcb4ea1bcb9701b6eb
SHA512 96fa04f101d6c599e0c98b2806fb8b0b0024e7ad2af8478eb3a6d4bad39ae5687bf28bf1984d3803e824146973a91c75312e791a6ee19043b539cd9ef56c260d
TLSH
T1C7E068B33EFB2850FC6B93C6203048A00049755098409D0F242AB2C724A13192016CA6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 c6e90af0e6aa2301961569499975cdbdeaa47da0f5ebc25bb07e059d177cb63b
MD5 03fa869a6feace465fbbfff64d89f28e
SHA1 d89d869bff8bc66c62604c49694fa806c8930b47
SHA512 fea66f5ae931eee6f16e5e9f5170b22264787279f569325364d1dd4a879fa7c81c6d5e69fc15f5372f75896120dccd9d02b805bd10f28768e9507c0a6aa4957b
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYrTi:0LppY93PBZJPtN53JpSi
TLSH
T17FB25A5A703E0211393E2988B39696364F4235A37058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 692546f0f78d97515c3c2815755cd2a1552942c84e59cd7eebf2dd76f501a097
MD5 ac2922315ee214415a23562852f2ef21
SHA1 784d07211ef4aa06d5f171fee503a48e468ee021
SHA512 0682a9adcfe1cacc7ee749ed4a72215d04484541b0ad8377f66162e21ae2e3935e4591c63b4878ad6389621cd0af65a3659aaadc04a8f627d34a99a823423330
SSDEEP 384:nEiFiZcIql3sN08TUNTUlI4QQckCrxvHpvBftGp+Mgj4Q4LdunXK9Li6Uq58bhP5:fFQy3twgLkcJjGPVQaunwLwD+Buv
TLSH
T145F2C3F298E38577D8AE8787A73D2E029AFCC163B5985594B7D81D0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2895366381f8e98a47d2191c0aabf058cc92fcfb5cc9c6f68f9e3c6a9ae1c93d
MD5 2048afd95d0c21b13bf2588d5735489a
SHA1 d79e99c6aaaf8e1ed5f1cb84d354e69409f31830
SHA512 2aa0f95af74e712232b66ffc22f8cdf48eb3dcd0572ab4a00e184ba294f53b4d6c6d2482e50659cbeedf09b6672ae7f488371415bd1229f92d49b4e89ec868a0
SSDEEP 384:nEiFnZcIqOsNiS8TUNTUlI48QckCrwvHpvBftGp+Mgj4Q4LdunXK9Li6Uq58bhP5:fFPXTSwg/kDJjGPVQaunwLwD+Buv
TLSH
T120F2C3F298D38577D8AE8787A73D2E029AFCC153B5885994B7D81D0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4cc6a9ee191ec21dfb02c26ff0c574a1f76e76fc377fd660a6de8a8a28c1fe85
MD5 d00527407f42c8da65dee77607fd9931
SHA1 6391d20be12065f49a1f81eb00265c5b2865747a
SHA512 4d6181147d1fb7d18e295cf9a024bd23d1ef772142109fcab13b36d591f2aec5a3ca00d5c3026e5ad1cbbcbb2f166645edcf7dbb6837f64b03894ae5d57ef30e
SSDEEP 384:npJiFiZcIj3sN08TUNTUlI4ZQckCrofHpvBftGp+Mgj4Q4LdunXK9Li6Uq58bhP5:pgFQj3twgIkXJjGPVQwunwLwD+Buv
TLSH
T1B7D26B72D864C97BADEB8BC5BB0A7603DEE4416395DC9AD4E9DC1D1C019B1ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 200e03e36b63de85dd911729ad4ae114a0899c37cc07f790bc532ec2bb8fd18e
MD5 045f18ccd33eaa39454e96771a406d2a
SHA1 7600e3f40c87f470c18afd79e7f14a21d6df4350
SHA512 1be8b847dca30ad7ce71f3ecbe1582313e7581dd22bab503f9f349d22be7056870f49621158e86038ced43d9f5e22075c3065d9ddf3d9a6195b0ad64f427b619
SSDEEP 384:nmiFiZcIj3sN08TUNTUlI4QQckCrxfHpvBftGp+Mgj4Q4LdunXK9Li6Uq58bhP+E:NFQj3twgLkIJjGPVQwunwLwD+Buv
TLSH
T173D26B76D864C97BACEB8BC5BB0A7603DEE4416395DC9AD4D9DC1D1C019B1ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 36a908bbc904f10044c1cfe42dfaaf2399cdcbcebef17aed1217eacee8dec9c9
MD5 772475694bb6bbc88014cebcda665f75
SHA1 a52e3e2e6f377a035b7ffd80b2d4d7f7cde41fc0
SHA512 2161ef36fd6dbe41b5566d8df4b8bd8f2d31a353bb31db63d3b2a9363419a6f869f95cf2420e2673dd17f128cb9119ed2cee4e657eb6cdff5112ef05ecca2547
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lGKpvBftGp+Mgj4KRphe4KV8p0PHTt+:pAFccps3iwgbkUwkjGPVKdI8p0PU
TLSH
T103B25D36EC64CABBEDE74F89B74A7A03DEE0526785D859E4DADC1D0C00931DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a78a17eb1dab967c3cc2da37ef9ccab30c37353723450e84abcd29ee31cebea8
MD5 8e72c28cf3c65c3b00802c9f1ea5f236
SHA1 07e530baa92907b83914b92b88d5bef012b6ce31
SHA512 d212df8700fd1f53b3b22e6db911ac6f4dec31c4af622e32f4767be118a04ce4f0e8a718af77523aa41036e05afcc09bb816db3f8315dc86f4dd4540468c6e29
SSDEEP 384:np8iF9CcmyWCs3sN48TUNTUlIm2QckCr9eW0pvBftGp+Mgj4Q4Lzune4KV8p0PHU:pnFccps39wgbkUVSjGPVQAunI8p0PU
TLSH
T18AC25B32E868CA7BECE64B89B74A7503EEE0526385DC9AE4DADC1D5C01D71DC530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 997a6e3390fbad10092455834a47f33c753734fbc848f07a656426eb4493bb4d
MD5 157491d7aa8502742a56b11c18eae720
SHA1 4b883f6f34b5be68ab90751e4fb62da14a0e610a
SHA512 7145bd563b20fc268b4efde53e1da750bc8ff2f8ec60292570f44f7d6187ce1dcc312d2cca2d62c908566aecaf975bd8a629219555452545716ca7ebf9acf7b7
TLSH
T15241145CBAE91148B3B76E5AABF6A86D487FBD372E07D45D10010E4E0662A40D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4620-356-0x000002686E9D0000-0x000002686F9D0000-memory.dmp

Download