hxxp://boatingsouthafrica[.]co[.]za/2022/08/11/breaking-the-mould/

Resubmissions

28/08/2026, 20:35

260828-zc6hyaeb273

28/08/2026, 20:33

260828-zby3gaej2y3

28/08/2026, 20:31

260828-zar8jataqd3

28/08/2026, 20:30

260828-zaex7sej2t3

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://boatingsouthafrica.co.za/2022/08/11/breaking-the-mould/
Sample260828-zc6hyaeb27

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324229542847568"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{2FDFB6E3-E373-4306-BE45-067DC215D7B8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
740	msedge.exe
740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4308	3552	msedge.exe	85
PID 3552 wrote to memory of 5808	3552	msedge.exe	86
PID 3552 wrote to memory of 4908	3552	msedge.exe	87
PID 3552 wrote to memory of 5808	3552	msedge.exe	86
PID 3552 wrote to memory of 5808	3552	msedge.exe	86
PID 3552 wrote to memory of 3160	3552	msedge.exe	89
PID 3552 wrote to memory of 3160	3552	msedge.exe	89
PID 3552 wrote to memory of 4992	3552	msedge.exe	90
PID 3552 wrote to memory of 3928	3552	msedge.exe	91
PID 3552 wrote to memory of 4992	3552	msedge.exe	90
PID 3552 wrote to memory of 4992	3552	msedge.exe	90
PID 3552 wrote to memory of 3928	3552	msedge.exe	91
PID 3552 wrote to memory of 3928	3552	msedge.exe	91
PID 3552 wrote to memory of 4448	3552	msedge.exe	107
PID 3552 wrote to memory of 4448	3552	msedge.exe	107
PID 3552 wrote to memory of 4344	3552	msedge.exe	108
PID 3552 wrote to memory of 4344	3552	msedge.exe	108
PID 3552 wrote to memory of 3708	3552	msedge.exe	110
PID 3552 wrote to memory of 216	3552	msedge.exe	118
PID 3552 wrote to memory of 472	3552	msedge.exe	119
PID 3552 wrote to memory of 872	3552	msedge.exe	120
PID 3552 wrote to memory of 4564	3552	msedge.exe	124
PID 3552 wrote to memory of 4564	3552	msedge.exe	124
PID 3552 wrote to memory of 964	3552	msedge.exe	128
PID 3552 wrote to memory of 964	3552	msedge.exe	128
PID 3552 wrote to memory of 740	3552	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://boatingsouthafrica.co.za/2022/08/11/breaking-the-mould/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc8260c188,0x7ffc8260c194,0x7ffc8260c1a0
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4222199139406039911,15484066416740411677,262144 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1061153369730916966,12914714575436079781,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,5668831619390065768,8436362508508869597,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,15172185348141784689,16750767876341740527,2097152 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6896582753727179697,17435651334516616203,2097152 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,210724271463580901,16738033009563571981,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,5306286853408264374,6795361215508502114,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17665275650060478015,12907285972023233569,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17665275650060478015,12907285972023233569,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,8227083932401851216,14636719003151714653,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9131364787814316040,16429404262112641131,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,12188787354102493110,1893458870391751679,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17078661012799378953,16851058235895572816,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,14886899861888208341,2040957977885431895,524288 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,13275429223555116719,4715832549753304770,262144 --field-trial-handle=2240,i,9573943816521682063,2727025259290190824,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e696d04-4eda-4698-a970-bb9e33b15afa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e696d04-4eda-4698-a970-bb9e33b15afa.tmp
Size 26KB
SHA256 73570d31bb88b88bea25035ccc4c935cf1e7bb6ef02ca8e049d91c67f5965d03
MD5 1b65c4018a9514e05b33d9afddbf8e51
SHA1 99435fe501fb2b11bcca6ac00f7ebdd1e08083bd
SHA512 f67ba7c7f29370a001e244fdf3d4b3d642e4256d1f3f136f42fe838345f13ba4b85b004845714f5f723bda936fc171c3a3dc93051f6e2dc0604f5269eb6cd0e8
SSDEEP 384:nmiFiZcIe3sNp8TUNTUlI4/QckCruFfpvBftG0oDti/7cL2cW9VLor2ty/7Ige7e:NFQe3owgqk7RjG02I7ncW9VE074Hv
TLSH
T1B7C24B32DC64C97BEDE68F99A74A3603EEF042239A9CAAD4D5ED5E0D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 113a6e5a4b40dc14cea296b0258ccd32b2676fc933ba11a967ceb2f6e8f1a42e
MD5 fdbd0059c7aaec54361bd9238c04ceca
SHA1 00351055278229043252ce6185bb704a7aa2be2f
SHA512 dea09410df1119b9b52ffd6ef52728d7d8eca1d0ae91d0efd04d3b4d3a191b3c7323b47e60b1c4519962aa33a54b14422a745e8089163360dc1d04bc22ad9e26
TLSH
T1CBE022A6D822EC275DFD4B28A0498A56E70013272A41994F3B3C82098FB472A46C9D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1489d9b98a15d6ee88b0dd8e90937fea2173c897226cc40e89d9f9d65d7a145e
MD5 974e426e4ef34f2e9d84a845e790a5e1
SHA1 08d2b47bc74d411a00a37c410ad1af6890798c9d
SHA512 60f4094bce155c4f2e628901e616b9c53a84ba5ec23565cbeb9d2ce8b30603d691b4d87c2db81627564c73ae5495caa90108c97679218ab40ba3fc6a6e54a411
SSDEEP 48:3SbQ+ZlO1WgNzXwp8qlHgrNctMQ9eA29XwfgVKYigZwDNiIk7pCltUF0+Na2:WQy+N0pxArN09gXwfgVKImiIkC8KmN
TLSH
T1E59194FAB583D665DBD40D3353D0F930797285C8FA075E8E1226C8BD1E9A796C20E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b253.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b253.TMP
Size 3KB
SHA256 3b0e1189dd365b51c9ba2bfce86b9a58f6360efd5f4d6b014e1bcfb8c017be90
MD5 48385c9cd3f0249a81ced3d7a30a76e5
SHA1 3a84500aeed75386a4cbe4cbc8cc56c3d47ba699
SHA512 bb254d60c247514032f6349fc5cfffa67a9450bb695a4c33b1f4c5900bef00eabbd5fc3cfa5d87580df13de62eb85acb332a28c96a96030402f513395b8964ef
TLSH
T1E071E7F4EA03D9A2DBE90E3393C1F230397185D8FA534D8D226384BD2E59758C10EB04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 16ee60b1ed0f0a17c0d0628b3b3555809a9f4cb5d211eae52970297e83ca808e
MD5 6bf1481b3ee079c40ee9fc50d3cc7a02
SHA1 741017e1f41e5af2b1cffd26bfe64aeee65be1ed
SHA512 3fe6ca99571b547307647c3074388b1e6aeacaf00d7574b6327e8615a716d4be72230f23afa6d826b500591187b47a74e0d3f0c2d246291b9c65c6624b4ff739
TLSH
T14971BCF383E48E6D9D1299F0AA147E2BCE2D0558436C3D1E89E4AF5BA3E2471D141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7f25fe32ca42b70ece98ea50bd238bc51f118bfbacf3d0b494db8e750eb6bf8c
MD5 74f2702e3b30587ee1b5269e7aeef064
SHA1 0480e7a685060a665ae75a803346f080a02a3c9f
SHA512 061cb0ac37ea9cc2dea1eb7e3a5015871524ef08fd18ac9b0def690d05b73144d3be19759a79b73c8d075e9713bfbd27b2c925a67596be36c5cf29dbd805168c
TLSH
T17531A0F783E8856E8A1195F0B618AE2FDE2D0510436C3D9AC5E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2b15ac6f94e70ef422c256ad0bad8f80cf18acfddef88be1bcd21d1845446ffb
MD5 ada6cd3e0975a26a2ee4ed04004c5bb9
SHA1 1161fbbb1ccc9e7ea9bc44e1dcc5565c2d545852
SHA512 9618d887f8af9fd763f9d3027541bd7e3046c044acd2c3862ac680b188030c713c7830801b5759a78265b9dd4cabedd8f9481587a938ab349c0a11e22b5f6d5a
SSDEEP 192:sxZGRUyMqZjK1Ml8UQjkv/ffsX95Zdszodp+JHW6+WNsiQ/YvtmlOd91XqIg5CzJ:sxZGBqIv/ffsN5zvaHbi/e1a0l
TLSH
T1E762F8166A349D7B8DDBC21AFA85BB53D6F90163E1905E4469FC8B1C00E77ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92b7341842026951e483f9bbbef897d8df478f75a051e79b342288259a0fcfe1
MD5 f49da93538881c5123c7544427d35e49
SHA1 4aa6f309bf981c147ee86bbba5f5097ce5860767
SHA512 64ef90badd9963808064452918ea7db3999e0dfce4aa31f42adac1cd26579f05a4ba45139059443736342f5b40dcd4173bfe419983444666d692c9427e442051
SSDEEP 192:sxZGRUyMqZjK1Ml8Mkv/ffssOwaZdXzodp+JHW6+WNsiQ/Yv+C+XqIgjzJ:sxZGXMv/ffssOwaz8aHbi/Hajl
TLSH
T14762E8166A345D7B8DDBD219FA45BF53D2F80163E2904E449AFC8B0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ef8f4ea59aff1231b3ccb0adc7d6fa87f55094c98cd9ae76a553389946f018c5
MD5 f0ed37aad804a08bccfa91d7fa0a6dbb
SHA1 79b7cdb1768dd42fb5176283c82ecef3654a02d4
SHA512 c43629bebba3cbcfc25f21c19e78da6369f954c690e475594fff77b9c5d143e7b80e462a503c079bdebf455f99393270be3c5725542a2717420753c151ba113e
SSDEEP 192:sxZGRUyMqZjK1Ml8Mkv/ffsX9waZdszodp+JHW6+WNsiQ/Yv+umlOdTXqIg5CzJ:sxZGBMv/ffsNwazvaHbi/sa0l
TLSH
T19062D7166A349D7B8DDBC209FA85BB53D2F90163A2905E445AFC8B0C04E77ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 923065a21f3bf8c8cd28e4900c4c18edc1fc8a78e939112a56d9b8fbfbe5a7ad
MD5 add656dc1c6a52ad5e4f63ac0f778d4b
SHA1 d6f2efa2ec82c7d6e33e986398c3c9edeb740434
SHA512 a219ecd396ed7d7d140963dc463e45ead7435e31acaf99f811352d305498e513a5b916a9b80ed31f1f30b81942b7cdc3d6e809b6ea60b8b58173500f8966cce6
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGH:05ppxnY753RNBvRJJdt7p5J9rL9F
TLSH
T1ADB27C5A703E0211397E298CB39696364F4235A37058E4AF7FB814A14F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 343e73d899d44a10914b7f6395b048030f1300fb51173ce857748426f027e7ea
MD5 3779b85f41b06a0cfb5dfae9315ebd41
SHA1 c1089f383d17ced4d51a6898d00bb5fc23cdd007
SHA512 de6b497cd7e6419d6082e4d75a136aaae7715a23f2d59dd9aba63520332912e86dbb88ed5cc35713351b33d36cb3732bbfbf7b75ba53edffd30f97389b1ebf6e
SSDEEP 384:n3iFiZcIS3sNp8TUNTUlI4/QckCruFfpvBftG0oDti/7cLQcW9VLor2ty/7Ige7e:yFQS3owgqk7RjG02I7jcW9VE074Hv
TLSH
T10EC24A32DC64CD7BEDE68F8AA74A3603EEF042239A9CAAD4D5DD4E0D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8d3088c208f0792d88dac9f499b9f0940a307e1d1e5b898332ac3a65805d7fe2
MD5 a785bcdbfd6b1599cc1d6f1d73a1d7ff
SHA1 b94ced0972a10969a78cf64e8c7d2be3c15f4719
SHA512 594d48a57b15b2dd30d52cde100103c88edd0334a4b0413ff4f03b5c02b0e75654e1f1318f525792eb0e9ad0dc2d272cf966882e712b7cce27acd3eb220ce336
SSDEEP 384:npziFiZcIe3sNp8TUNTUlI4/QckCr7FfpvBftG0oDti/7cL2cW9VLor2ty/7Igei:peFQe3owgqk0RjG02I7ncW9VE074Hv
TLSH
T1B3C24B32DC65C9BBEDE68F99A74A3603EEF442238ADCAAD4D5DD5E0D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1d60b16c38de7222c64b2823f4a32719bf9e6142a753bacc1c7cfd5172a2a323
MD5 e9897d630c3acc13b8d93b7a9e7cf9fd
SHA1 19f44e25d8dfab23edc5de54dfb5ad6e57d68f8a
SHA512 13f2c96e1fe9366b6df265c0219856476daa4ad6c61296bf91ac5eefcd16ffdf2e8fb0d271c419335e3fb05b384fcff0883ca49241b69c4efe6cadf424244ab5
SSDEEP 384:npYiF9CcmyWCs3sNd8TUNTUlIm2QckCr9yl8pvBftG0oDti/7cLEcWe4KV8p0+Hr:pjFccps34wgbkUGKjG02I7XcWI8p0or
TLSH
T1E2C25C32EC58CD6BEDD64B99F70A7503DEE0426386CCAAE4D6DC5D0D10DB19C430B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 976c162fc33a41cab8f911893c0c153eb7466e3f85e295f919197eeeca3bda31
MD5 6d482764eb530a818d1e143d3382f098
SHA1 b20d2e81399460a017b2c1026d8a5917fb7edf97
SHA512 ef94bc6b334b499ff5314898fddcb792ab3505404d40a5e3877a18303126bc6a19bfd47e2226a7973db4ef4841ea9cf0e224872496e1fa87a639793f1a4d8c88
SSDEEP 384:npziF9CcmyWCs3sNp8TUNTUlI4HQckCr7FfpvBftG0oDti/7cL2cWk4xty/7IgBa:peFccps3owgMk0RjG02I7ncWkva
TLSH
T1DDB23A32EC69CE6BEDE68B99E70A3543DEE0416385CC9AD4DAD91E0C11DB1DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 11006a4fbfaaf716ff45c5b160165601fb88fdf0f0084a52d87cca6e08a7b1b5
MD5 885afc7b1d1616a4c41caaead390aac6
SHA1 c8ae9a5194c9a48782a6c05a432dcb17dfe0145c
SHA512 fa3b2344fd68b05d31898b746cdb5c896ae2a1ced5664f638b9c715c643b74cb1b9bc93f4310f1f1bbfd16f7a238452876e056fac5a99efe3529536f02ad7342
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9ldKpvBftG0oDti/7vJpje4KV8p0+HFB:pVFccps3GwgbkU/kjG02I7vPI8p0or
TLSH
T115B25B36EC68CEBBEDE64F99F70E6A07DEE05127859C99D4DAD81D0D109719C030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c21befc78fc4339e1fbb88070314efc70efa5dacf274948ae10f91d92863c81d
MD5 96881986fe198c161233f354d41f5684
SHA1 4e897ce31264f1f3fee315b1bc07887c6e5378ed
SHA512 409d9154334f7ac0ab08c5abef5a8d335d27062e8920b0bc64b809fe044b1301aa64af65001f5c5777eec55d530fd92e381d93d54cd792608ff189f6d9a746cd
TLSH
T16941D9A8B7F91158B3B77F5AAFF6A86D447EB9772E06946D00110D4F0632A00C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3708-359-0x000002716A5F0000-0x000002716B5F0000-memory.dmp

Download