hxxp://zoologyfibre[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://zoologyfibre.com
Sample260929-pgaxqazzev

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5008	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{91E8CEE9-C879-4256-93DD-A17CA40BCCAE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	msedge.exe
764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 872	3260	msedge.exe	88
PID 3260 wrote to memory of 5008	3260	msedge.exe	89
PID 3260 wrote to memory of 1444	3260	msedge.exe	90
PID 3260 wrote to memory of 3760	3260	msedge.exe	91
PID 3260 wrote to memory of 1444	3260	msedge.exe	90
PID 3260 wrote to memory of 3760	3260	msedge.exe	91
PID 3260 wrote to memory of 3760	3260	msedge.exe	91
PID 3260 wrote to memory of 532	3260	msedge.exe	93
PID 3260 wrote to memory of 532	3260	msedge.exe	93
PID 3260 wrote to memory of 532	3260	msedge.exe	93
PID 3260 wrote to memory of 1660	3260	msedge.exe	94
PID 3260 wrote to memory of 1660	3260	msedge.exe	94
PID 3260 wrote to memory of 1660	3260	msedge.exe	94
PID 3260 wrote to memory of 3380	3260	msedge.exe	95
PID 3260 wrote to memory of 3380	3260	msedge.exe	95
PID 3260 wrote to memory of 3380	3260	msedge.exe	95
PID 3260 wrote to memory of 3376	3260	msedge.exe	96
PID 3260 wrote to memory of 3376	3260	msedge.exe	96
PID 3260 wrote to memory of 3376	3260	msedge.exe	96
PID 3260 wrote to memory of 4736	3260	msedge.exe	100
PID 3260 wrote to memory of 4736	3260	msedge.exe	100
PID 3260 wrote to memory of 4736	3260	msedge.exe	100
PID 3260 wrote to memory of 4848	3260	msedge.exe	102
PID 3260 wrote to memory of 2272	3260	msedge.exe	101
PID 3260 wrote to memory of 4848	3260	msedge.exe	102
PID 3260 wrote to memory of 2272	3260	msedge.exe	101
PID 3260 wrote to memory of 2436	3260	msedge.exe	106
PID 3260 wrote to memory of 4336	3260	msedge.exe	119
PID 3260 wrote to memory of 3360	3260	msedge.exe	120
PID 3260 wrote to memory of 5112	3260	msedge.exe	121
PID 3260 wrote to memory of 3344	3260	msedge.exe	124
PID 3260 wrote to memory of 3344	3260	msedge.exe	124
PID 3260 wrote to memory of 3512	3260	msedge.exe	125
PID 3260 wrote to memory of 3512	3260	msedge.exe	125
PID 3260 wrote to memory of 3512	3260	msedge.exe	125
PID 3260 wrote to memory of 5084	3260	msedge.exe	126
PID 3260 wrote to memory of 5084	3260	msedge.exe	126
PID 3260 wrote to memory of 764	3260	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://zoologyfibre.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff86622c188,0x7ff86622c194,0x7ff86622c1a0
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,6071775807681711179,11220033614550581598,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,10857997531836790286,12244822279438605799,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,14143665546463235226,6267342421976256875,262144 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,14342716209655013166,9772071101308340074,2097152 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6143076197587505774,10291842850470658244,2097152 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,10661880662316881119,14664249559992211711,2097152 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,5478450565709674242,16458186313719817919,2097152 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3568,i,7367413291965775862,8415097077366364466,2097152 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,14948371043039135092,4724761715533125086,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,4208474463964321314,13255185742390785605,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6571756657631775209,5184061476250182786,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6571756657631775209,5184061476250182786,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,10249799606534421688,9939459781600852740,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,11574225169424658476,102560101899819641,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,6256427958156543824,6546271552952733255,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,221364017400507084,5559293277208852227,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5456,i,9616194532549833234,6836196659870813480,2097152 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,4105084158949572918,12027002005412609734,524288 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3708,i,1291194664907858901,12106037274849286080,262144 --field-trial-handle=2356,i,6019953089693026465,6213988134351624639,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 806b48d32e55573c93f3fbeff2080a38fe248fda449d6e426ed9952c28a5d2ad
MD5 676c969c0d741526dacd67665bff7cb5
SHA1 04f5b4fdc4b568c12f3e8d2f0e56b8bd3d633d2c
SHA512 52ec3ab48018ec8a07e9fed1316eab48ff6db33cd3f1174cb5a0da93967ba488d222c51ad600e2795bdde1a997ee69ddf68606bd47b7dcf02a89563d46dc6b33
TLSH
T1D8718140FFD87869F7A8BFB9DFE704873AB3678016A7ED409044D9F96E063925061391
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a7fe844270166907db5f030e155da1df422f200b95aa079d3f7468c0e7d8d480
MD5 671bb51a9bf72a2af66b31beb42a3d63
SHA1 f5735b155c5e75aaa4217d0fc918e4b0ab59e223
SHA512 b555f48f3c302432e68844cf9681c30b9bbe3ecad5e162c8044374bdb76e6f3c1917861bb5d70834b6d70b0213f705facad4b7a4d7937f5f29a4ef7e55571a0b
TLSH
T182617E80FFC578A5FBA97FB9DFD710833AB3A78016A7ED409080D8F96E063905060350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591b10.TMP
Size 3KB
SHA256 4e8cf87e50111173807ab2ac9c54325804239e8bf22a3b7010f2473761b4a3db
MD5 5b18e653a4bc0248ffb356d6e6753ac4
SHA1 2e981061a64ae4f3e9291ed36e6af34959937094
SHA512 ec649de9faf86b5adbbd6b132d1492253fd465775a70f87f78deed8abe54f105d9e1609d30bd76526244e24714664bbaa54ad17c9206fdcb92e2e46b8feddf31
TLSH
T197618F90BFC078A1FBA87FB9DFE7148336B3A7C01AA7ED41A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d795f9f6fb8d02a319c98f8597ff857e3a304c400f9c4a00579c058f2139040b
MD5 4770613728cea1587cb96bce2ccfe63e
SHA1 63cfd284a70445ff64869d0458dd7db04a27a11a
SHA512 d133384f81df34afb79ae903d7efce929c2712d34b1c0d4a9ebb208d8b658be3f1d16a9ce229f2947d3472eaf2d95da86635a6788f06c01afff612be8263c1ad
TLSH
T1098179F7C7D9866EC90156F49B15AF2FCE2D0A18421C3C2A88D8AE5BD3E2431D115B9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b4afe29d3e46b944108f5e7d9ed4c47c4a8f96aa2863732630314a55739c9abd
MD5 4032fb298ae12440da1b585d38f268a3
SHA1 bbb108d7610b160ca1ef8fff6e243c29d80faac7
SHA512 85f418b11bbcc5eed07050f2694cdcf6de35433801ac8c4b1bcad7db9d46a261c95da14dc242f0c6dbf0656c837fe480a4cecb0f872d549e2c95166a9f6b157a
TLSH
T191D02223131830F6A66C7EC290AAEE8FC37680614883D9E812D0989C09764BC6A47181
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe599495.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe599495.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bf6726dfdf6356c87a5833800c77ea6a0b181b6e27d3bdd6116659ccc80d443d
MD5 4405511a4fbbe3ba5f1551d8bf59adb2
SHA1 30d1c5e545c738c34bde7195f508761fc88785b4
SHA512 b9f1abbbcc8556bb0404760fda4d8339c65f0d511860d5a05e77dda16431bd27da20f52d4f81805544aa043cd6782734509da01732f4beca5951794f5ba65f3e
SSDEEP 192:sxZlRTWW/f3sYvIdpqTjSHW6+WNrL//Y36xln+IgrJ:sxZlwW/f3sYASSHbH/Xv29
TLSH
T17822A9536E38A97B4CC7D209BA25BF13E6F9503291D51E98B6FC961C04E67DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e6f04b474bff0ee81a9fc1649460f2d994be8ed186969c9a619bd3e7b2f9d9df
MD5 0fcbb27beeae2744aba8dc88d4783d3e
SHA1 ce0ca541078b931dc226de1e1a4d48443e09152d
SHA512 296629f147b30c01ea7ae03686289d3f0248cab955165c292e9d1d6a7eaca6b7a3ea605c0e0ee732a3f3166519db901db82d057dbc78f825682cad5732c6a271
SSDEEP 192:sxZlRTWW/f3sXZIdpoCtHW6+WNrXUdY367ln+Ig53J:sxZlwW/f3sXyVHbwdXp2z
TLSH
T10132C853AE34697B8CC7D209BA15BF53E6F9503291D51E88A6FC861C05E7BDE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b126b3b682aa019c149a0da9948973040241b88ecf323e2053734d55bf035409
MD5 a61aa269ba3655a410d8e88cf970a636
SHA1 2c621f9bf4d0a1aebc0903690377c0d539862d59
SHA512 b7f2d488dd52cf64ed5ca21c17d0c41455faaa0f113ee87bcc6d8c99b39bad58bba949768034050dbc37b5c4882f2559396ec42758fa18a2b56eb5b0edb3c844
SSDEEP 192:sxZlRTWW/f3sXvIdpqTjSHW6+WNrNqXY36Rln+Ig53J:sxZlwW/f3sXASSHbUXXP2z
TLSH
T16522A952AE38697B8CC7D209BA15BF53E5F9503291D51E98A6FCC61C05E77CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2a0b5b006e1a4230d0936ab43ecde5eb9940e29bd5b34e8b592154581504e2b5
MD5 f09205db60b2e08885565f7c4a7d0943
SHA1 fd6f4a4873af84442d05ae102921ab4248c49666
SHA512 f1c86cfbd32c15c604aff59d62c82f3e63d007324ee7687d5ee6f927afcd499aab173802632d328c271eb928562569cba4ebc52357fc4aeaf712bab97da45d3b
SSDEEP 192:sxZlRTWW/f3sXZIdpqCtHW6+WNrXUdY367ln+Ig53J:sxZlwW/f3sXyDHbwdXp2z
TLSH
T15422C852AE34697B4CCBD209BA15BF53E6F9503291D51E98B6FC861C05E7BCE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4931cf2b462f819d5eda9b556978f0bdecdde87af88fc73150f70e0fb61149dc
MD5 ed6c64a5a8e21be7bb29f638937ce95c
SHA1 74fbe55e9656c4094245bedd53c87964ad2d34d2
SHA512 d676cb3ab6a9e6f53fbacacee2d7a06c15f3a7506492ac1dad756aa660048d06820e7c654f6f053354e0e55fd4543340b33be5cf3fca2bbc9a771dbdc0e62666
SSDEEP 192:sxZlRTWW/f3sZvIdpqTjSHW6+WNrL//Y36xln+Ig5dJ:sxZlwW/f3sZASSHbH/Xv29
TLSH
T15622B953AE38697B4CC7D209BA15BF13D6F9503291D51E98A6FC961C04E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0f693153a5ac6a7be9d2144d4aa307c2f334d745252892eceea789898fa3eec3
MD5 20fff84434ecf97087cd66bb534b0525
SHA1 6fad058eea30afeb05137ece96b6cc3109365466
SHA512 036d0babe0ce9ff94d056110bc1d978ee5d9937f0eaf29661fa49cbb4871f7327985f9b38e9a4879e9cc665cbb220ae666589d28fedcf138855c5e321eba1ef3
SSDEEP 768:YeKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/NrobzE:YeKlm7QWvUYe0u1ja8/L/E/mbY
TLSH
T1C5C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

042a51272bd748f3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\042a51272bd748f3_0
Size 193KB
SHA256 cc855f00be18c03a821e4b170fc1410367b91d081ce9d24f8bcb518b74a24823
MD5 1b43e2ff9d54cb912993ebfb64d928c2
SHA1 b096aaef54fb62b598e3c0783199447df65c4376
SHA512 fcaa25dd0e044d3fbe41b6eb31c6f27b820819e4141a13fbefaefcdf9ce743ea98ac8a6719835b472189fbe1b58ef3a591ff3c818c6ba612c6fe4421ba1085cc
SSDEEP 1536:5oWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:grFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T199145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 1ea2c6975a0c3ae94485ea110678ecf08cf361140cc331da399231a471e308dd
MD5 e909b9fe1790ad957af18100802ef5f7
SHA1 130b7aaa99c26d80bd4ddcfd5725c2f12d97a19f
SHA512 82273497cbc8908c4e76027c65c78752ca61640e93200375191855e8e09e1af43bd4642cd04867315bd71eda1701917767f736d9de46197c102d36c143adabde
TLSH
T1E4A00228C1C50856CC4047B820C5155527368C646A5D83134DA0F14CE96225149150BC
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599735.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599735.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 135445b2065f0b2ed81dd8a2c131a05c71daa3001ad82bcdb1396c506e5eac75
MD5 ea0dcbb79ad48a5e114380e5460a8237
SHA1 dd073f0b6786c14fa9c17ef123a403bd591d1004
SHA512 39684e714c969deb3d438fc87cd3ac2c4fe20ef540dcd73c3998ed741ed2a9d183ddcf03b13c3deb18c7aa4c9701f13897bc761695fd4cbfb57c98c738628c08
SSDEEP 384:/ZcIhsNAeSbA85h//z8ExUXQH9tgOIwZOy8xoh:Xh33/D8QH9Xs5e
TLSH
T14F827C32B878ACBB2DE7A544F54733035EB48427E7C55F94D6EDAB1C01DA2A8130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ec56356bbb6270980cf64e221814b69c3f8e8d1b2a2c9e0650114495cb0bfe98
MD5 f51721cd4e010fcbabf278def2f380e6
SHA1 ded7ec50af7f1ef38d43b765a3b4c70a5bdd7368
SHA512 cc63b01fcbd5673d8277ed5a930b56d16f7f45ab8b79d7cba2deda0c70e437f15d400170ed19cd12821ea01730b0b5028f7bc82237d6206dff5f8cf30fe66d26
SSDEEP 384:tiFiZcItzsNA8TUNTUlIljSbAw5h//z8ExUXQ59tgOIwZOy8xoh:kFQVBwg23/D8Q59Xs5e
TLSH
T15DC218F298D7887AD9AE5743A73E2E025EBCC067F5859A54B3D85A0CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1f4b4eb7b8b3a31e83d4eb58e89e35f0f660837c402ed588f21bade682a09910
MD5 8ffeda370b52e5c705647f915b2b0318
SHA1 57dc82dd8906f71011e527bbd7d6989fef8cae60
SHA512 261f11b02e09d8c58ecaf22dc5b27b8a3a6bd4d96cf02ef1ea8d025ac60d311e853246c3a34eb92d5ed4e200d41ac75dd935197f8aeca829bab86c733e030f8b
SSDEEP 192:BONN6JUm0QmiUyvEso//jjzorB6ywxWjBCqaU6:BONN6+mE7so//z8ExHRU6
TLSH
T1A502C839BC287CBB9EF3AE45B44737139FA5107BA6951F80DAE81E2D01D725C1306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2e66fee67ee18d93e7b4999cd68f2c2dff1afa1aad2fa1d10e143d6d3560bbee
MD5 e7fc21ffa83a4c652786b8481fe19058
SHA1 9f71fcde6c1be836585eedacf6660ce8a745117b
SHA512 f6c880d432c67ab658f4bfcbe7cc6eeb86ca16d394f836b173a662ebed5af36d8e22c5c2b3f98db006feeb57d80fd9f026c4211417bd83f84272b9765e6d0563
SSDEEP 384:2ZcIhsNAjSbAB5h//z8ExUXQH9tgOIwZOy8xoh:khd3/D8QH9Xs5e
TLSH
T173827D32B878AC772DE7A544F54733035EB48027E7C55F94D6EDAB1C01DA2A8130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 74da478b4182871369481353c095ebf4134524e1a7355bd73eba0e3dd559416f
MD5 aafd3acc46bb3d2f21c95ce707f71c7d
SHA1 368c20ab923bf4f9ea833a615974af53d79475b1
SHA512 9fef697991bf82c76ebe45cf1fe19070833187b0fd8ae69207e2e609152679473c2c65a8fa533b762e18a16e141d7f49b0117e24c8ba8afe9815d9664b7a89e9
SSDEEP 192:BONZ6JUz3QmiUyRE7o//jjzorB6ywxW5XQRNxRq0U6:BONZ6+ld7o//z8ExUXQR9U6
TLSH
T174120B36B878AC7B5EE36945F04732139EA4412BEB896F94D6EC2F1C05DB25C5306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38cda692-8f39-4162-bd8f-34a1a0b51971.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38cda692-8f39-4162-bd8f-34a1a0b51971.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ab7b24338a64bd246bc27f456681089d8b6fd513e5584b390d0a71bf2bd9073c
MD5 35dce28b5f19ca16a80981d3e502d31c
SHA1 746d31fc548d2146fb153db4d3c1036e6e486f00
SHA512 5599e532c116474cd190fbc908ba32d84dbcd2def8bbb3aca3a21cc0fd6d51800ea70eacfa7ae50cff1acf381e107be465b5500ed05130f69576c4ea9d34cecc
TLSH
T1BB412A58A7EE1158B3B77E5A9BF2596D487B79372E06905E00110E4F0A73B41CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download