hxxps://cdn[.]discordapp[.]com/attachments/1535061184708091974/1540344352939712522/ZeroScript-Free-1[.]5[.]2[.]zip?ex=6a899cf7&is=6a884b77&hm=e0ee5c227fec9a78e9a9d4843a3f8db236bafd130330e60e927fb9e1ab31500b&

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1535061184708091974/1540344352939712522/ZeroScript-Free-1.5.2.zip?ex=6a899cf7&is=6a884b77&hm=e0ee5c227fec9a78e9a9d4843a3f8db236bafd130330e60e927fb9e1ab31500b&
Sample260821-p8dspavsft

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317907889032045"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{9F42D127-0D56-40D1-BB28-D453CA6B412B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3364	1032	msedge.exe	89
PID 1032 wrote to memory of 244	1032	msedge.exe	91
PID 1032 wrote to memory of 240	1032	msedge.exe	92
PID 1032 wrote to memory of 240	1032	msedge.exe	92
PID 1032 wrote to memory of 240	1032	msedge.exe	92
PID 1032 wrote to memory of 764	1032	msedge.exe	93
PID 1032 wrote to memory of 764	1032	msedge.exe	93
PID 1032 wrote to memory of 3284	1032	msedge.exe	94
PID 1032 wrote to memory of 3284	1032	msedge.exe	94
PID 1032 wrote to memory of 3284	1032	msedge.exe	94
PID 1032 wrote to memory of 2516	1032	msedge.exe	95
PID 1032 wrote to memory of 2516	1032	msedge.exe	95
PID 1032 wrote to memory of 2516	1032	msedge.exe	95
PID 1032 wrote to memory of 4548	1032	msedge.exe	96
PID 1032 wrote to memory of 5372	1032	msedge.exe	97
PID 1032 wrote to memory of 4548	1032	msedge.exe	96
PID 1032 wrote to memory of 4548	1032	msedge.exe	96
PID 1032 wrote to memory of 5372	1032	msedge.exe	97
PID 1032 wrote to memory of 5372	1032	msedge.exe	97
PID 1032 wrote to memory of 5640	1032	msedge.exe	98
PID 1032 wrote to memory of 1460	1032	msedge.exe	99
PID 1032 wrote to memory of 5640	1032	msedge.exe	98
PID 1032 wrote to memory of 1460	1032	msedge.exe	99
PID 1032 wrote to memory of 3568	1032	msedge.exe	100
PID 1032 wrote to memory of 3568	1032	msedge.exe	100
PID 1032 wrote to memory of 5948	1032	msedge.exe	101
PID 1032 wrote to memory of 5948	1032	msedge.exe	101
PID 1032 wrote to memory of 5948	1032	msedge.exe	101
PID 1032 wrote to memory of 5748	1032	msedge.exe	103
PID 1032 wrote to memory of 5316	1032	msedge.exe	105
PID 1032 wrote to memory of 5036	1032	msedge.exe	109
PID 1032 wrote to memory of 4832	1032	msedge.exe	110
PID 1032 wrote to memory of 5736	1032	msedge.exe	111
PID 1032 wrote to memory of 3788	1032	msedge.exe	112
PID 1032 wrote to memory of 3788	1032	msedge.exe	112
PID 1032 wrote to memory of 3336	1032	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1535061184708091974/1540344352939712522/ZeroScript-Free-1.5.2.zip?ex=6a899cf7&is=6a884b77&hm=e0ee5c227fec9a78e9a9d4843a3f8db236bafd130330e60e927fb9e1ab31500b&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7fff85f3c188,0x7fff85f3c194,0x7fff85f3c1a0
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,7007741212074602128,11131888558328450045,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
  2⤵
  - System Time Discovery
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,14817604727076192406,8411743906422241580,262144 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,2189134283278646808,2617590028124645335,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,3852274958349429182,16585085959271215099,2097152 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,8889625078846560619,17389546739237268609,2097152 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,9864811528183878234,16402918159472807248,2097152 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,17984000117500420763,10103692469228180436,2097152 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:9
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,11842990251784651014,12549394642937883099,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,7012100435228286007,11012813770541947318,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,5767515438730224110,6053300452590948354,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5820,i,5403989992151825573,12382170417788139107,2097152 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,8561911210665245993,35615370476756917,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,16129951164905792585,3649126177289318767,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,16129951164905792585,3649126177289318767,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,1712570906842713988,17687191405717007992,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11171937386448969666,2311448930624843677,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,3201824997628917087,7652510303029917543,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14246247911114856139,6775138511531231482,524288 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7112,i,17312124651947078694,5738260325707840639,262144 --field-trial-handle=2516,i,5202653043945301453,2592107796659054918,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

98498fb7-5a44-443a-86a0-78cb919c9819.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\98498fb7-5a44-443a-86a0-78cb919c9819.tmp
Size 33KB
SHA256 2a26001dc71c6a939fcaa7b17254949990569817c692f9699d341249db007207
MD5 3707760ba9d136fa0022357ccaf87bbb
SHA1 c34641d4b65f7836406a2869972ec573fe1c4e90
SHA512 a0c87aceef73b34d33c65d983fadede06ea24d433fbba943d8e3ba1344d0295aeb27c340b33446962291b90fda6e86ed358112877e671fcf72ccb1c93594223a
SSDEEP 384:DZcIH38NDuFcdo7FWJDZNfNoXOVSUUNm/1iZXETRzcoXfK86sfxEZxxsIj4lBEfR:bH3DWDZIO0NSIZUNzc4ReyIsPEfcOn
TLSH
T129F2BE31AC68CC776CE59386F64636877EF59127C2C8AD90D5DD6F0C098B6EE131B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f875851416111d422fbd0a75d83cc303eaac081d15ddaa754c57e97b51c69ab9
MD5 8885bfab036ab0bab1a9d94442b00fcf
SHA1 1cb35aba2ffb42c5ae4a575ef4f5c8102fabc44a
SHA512 9ae12965ed2947ebdb940080bbefb9703b05702731bb432012dc520148ab6fbbaa8d8785c2d7e01996e61c48aeb882d282d4538e1a8db9df63a33210deb459bc
TLSH
T11251C658837B08CED36104B6ADD9D6693BBBBADC9007BEB95454353CA94332480E0EE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fb6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fb6d.TMP
Size 2KB
SHA256 d8a1a50df56fb4286a5fe7719e9addc546c87dc629f289904b89e6f212dbe359
MD5 b7024a0b9b8996e91bf09483c84829cb
SHA1 312630de0f4eddf4b458663732f4bf3a27f1be49
SHA512 e1112aafc5a8965026f476bbbe69020472db87282d70e4f45e5a71676c91d4927f5dbcfedb25835c71a8cbd1cd0ed652d7dd6f31184ad930d5ddd6b1f79116e1
TLSH
T15A51C758437B08CED37100B6ADD9D6593BBBBACC9007AEB95414353C694332480E0DE3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c22d8296-0f07-4a18-9b4e-bafb12e571eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c22d8296-0f07-4a18-9b4e-bafb12e571eb.tmp
Size 2KB
SHA256 00945481afef84a1aa6552edcb0ed1c3f5e0b882120a3dbcba94d45084aea969
MD5 7c447117e3cdb19456c6b7d7d4c9d694
SHA1 a7668680e478cbebf632b57eb3f3ed25c4cd9996
SHA512 37c9021bffb4d6540a86a0af4ed9debcc6aa76ba26004029f48433cc6e10c1465a86bc7b97873931f2face84e5a07f1cd57e7b67c9ff6e9347f9a1fd9d5ddc67
TLSH
T14F419CF783E4856ECA0556F0AA146E1FCE2D0515432C7C6A89E0EF2BD3E3462E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 db067ba81f0369bc89b6e7b4cccefc8f70084ff109b4d6a2278db4bda2e62dbc
MD5 95e0285ed73f24ba2e66fad7005e7cec
SHA1 0d6ddad8e825556f9c4d928d9a1050088a760155
SHA512 625c3e38cc63e749bbe07957a0a7f8790cbf3d74e735a0654a32ba55a649825adacd22ca940f6bb946ad0dd3de7cc859e6b946d712ca22b52e7583f2c8558106
SSDEEP 192:sxRqRtOQ/f+s3nprQ5ezoA8pi/g6+WNIYnYUvh1G+IgD4J:sxRqqQ/f+s3nOi/5I54Bo
TLSH
T14432B7166A28A93B4CC7E21DFB55BF93D6F95032B1D46E58A6FC8A1C04E76CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0b5cf903e9ec971a97c97d54562cf67f8275c03c35919986ec5afdf3bca9fb36
MD5 7e3d09c2faa56be20bd68a64cd2acadd
SHA1 9a814295f65c9fc80967e287220ca55f1966a353
SHA512 17857288bf4098f242a0094a326ab7518d3e1f02adb27aced79de99bf00a12a438692e9caab8f18464f23836e913d5b110c23f69f928fc8982f87b7557a76089
SSDEEP 192:sxRqRtOQ/f+s34prQ5ezoA8pi/g6+WNIYnYHbh1G+IgDKJ:sxRqqQ/f+s34Oi/5I5NBi
TLSH
T14F32A7156A28AD3B9CC7E21DFB55BF53D2F95032A1D46E58AAFC8B0C04E76CD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4f77a8edbe18764e32b2250b8d9c02fd7c33327fa791c77dfc7de4dddabde02b
MD5 6956737ab1ae7e01a55d60753361504f
SHA1 8b0b1867b11dca1aa5cf8c5555d95ba6485a8e61
SHA512 a9c3ea0535ecc1e7992438289c6ee40d5ab76211a9934f9c8f6ae03ce4c8c8b0bb27547b62ce893ebf068bfe50731861b09ae9df1abd752623d987fa070bae88
SSDEEP 192:sxR9RtOQ/f+svnprQ5ezoA8pi/g6+WNIYnYUvh1G+IgIJ:sxR9qQ/f+svnOi/5I54Bs
TLSH
T13432A6156A28A93B8CC7E21DFB55BF53D6F96032B1D46E58A6FC8A1C04E76CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 42d8cb2b64809b2d772422cd638b260570d7c6c9223e69efa99a68d9b5ef1de5
MD5 5a042d8e268b5dcc2da701c6974f643a
SHA1 5a65482e801760c6828afc219d4d66eca8ec6a51
SHA512 c9c38bbc080c995569bd3d69d08514015939613f4f5fc178ef7d4c9bd11b858b567ddb77572014255988652b9bde4d5db97ffed57cb274317808053c59d30e4c
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPHrohMZ:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0V2
TLSH
T1E5B2EC3B604DCB7E5F800AADEC19AFDB6D9802C79A988D4447FE990C03C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a96c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a96c3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d258c78f5ae197b2943cf1181345b2d1de5974f7db5cd5867594a4931b3ee042
MD5 46783b8bc1fc3bdc7fc834df2c1fabf9
SHA1 ac980bd0d17136534acfd9f020059da24ef135f6
SHA512 a583ca367014887652c02e32fa2e408e03148f9b53a5d67d45b8a0be8fdbf69a4fcaf4d1b13bda9f74274a61be3df5518a9681bbd68567d5661fe54b1f476a04
SSDEEP 384:UZcIH38NDfFcdn7FWJDZNfNoXOVSUUNm/1iZXETRzcoXfK86sfxEZxxsIj4lBEfR:SH3VWDZIO0NSIZUNzc4ReyIsPEfcOn
TLSH
T116F2BF31AC68DC776CE5A385F64236837EF59127C2C8AD9095DD6F0C098B6EE135B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b215cd4db331b05a81d32dea8f5adbf2aa8c877d7686f51ce829f914ecf076ec
MD5 248a9c49c8cd7e21afc58740ee9adc73
SHA1 011cf8abba4dc455594939da823596eacbd59343
SHA512 daf2f4bb8ea578719cd1702cc03108d2feef4d737881113c0b9f907af9ce09a46fc6509a5729656f284c454238adf51feb711d1f1d81b3eb6140cc8dd467635a
SSDEEP 768:PFQW3qwgUWDZIO0NSIZxNzc4ReyIsPEfcOn:SW3Ltc44bsMfcOn
TLSH
T1BCF2AE32AC58C87BACFA9B85FA463243BEF14167C1D9E990E6DDAE0C05475DD134B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c195f7ab7f5e0931e6388e80253cc25b72420e9a5e2283ea055a7e18360962c3
MD5 d4c42004313ad865c32e51912d808479
SHA1 ffe4fcf0fd6c3e23ed2c171bf43c699873406867
SHA512 75c5f5b84759bc10aa6fd80c2d83d31d0a7bdf4687fc60770c3dae84e0bff6d05b7713423bf5c868174b8087ab7f481dd89c25b43e84b933562a8665d749fd71
SSDEEP 768:Wrv+4UNbds3ogDZIO0NSIZyNzc4ReyIs2EeVH1S5D:WbsbS37tc44bs/EH1Y
TLSH
T1EB03CF32AC68D937ACE66786B44776533EF8921B82881ED0C4DD6F4C0A8B5DD131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4b3ade035bc49bcea99e8482c8e8cba17583a079904ec1f61b9e804d77d8f2c3
MD5 4259276383c86db724ebec68b3442d99
SHA1 6ed641f4e1ad7caf6510fdaf8ef4b595e15e52b3
SHA512 203497e9c27ea9d09c99b1764a2208776b98c5e403588a226013b3a6dfe4dd3b0b4647045444e33a66260a125c215f2f3bae86406d838016c7724947c9cbfa4e
SSDEEP 768:6rv+4UNbds3HLDZIO0NQNzc4ReyIsXfeVH1S5D:6bsbS3Rtc44bsPEH1Y
TLSH
T1C403CF32EC688977ACF66786B54776133EF8912782D81E90C5DE2F4C4A8B5DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ZeroScript-Free-1.5.2.zip.crdownload

Path C:\Users\Admin\Downloads\ZeroScript-Free-1.5.2.zip.crdownload
Size 1.2MB
SHA256 d7f98a5925d440e059257b33af2953389f6e04787e3df03ac6bb553e357c05b4
MD5 6b655072e97d39987ec853b86c844c81
SHA1 593db9f0666d51c14e7d4175c8af9e839e9d3847
SHA512 30c84a1ac42ecb0ab2cc4d7e5d6916459fa018670278bc478f547198210cea76e6e99378f5cbd1c87583e5102dcd8d15c14b6c763fd17da0b551cd2b3de382a4
SSDEEP 24576:0tfjuiL2q5VIw3myNlZYk3WYjGbIZ+twQ5EXST3OetQy9tPUhP/PKCnkXo:0tf6iL2q5VHNNl93FjUIe5ESzOejQHPD
TLSH
T156553335FFC80D2BC63040F06F5892A9C710299CB71E9BB6AC7576353E2B5393CA564A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download