hxxps://pinnaclegroup[.]co[.]tz/sm/hiworks/?id=tmyyhszzgeoqbviyazrawcsddotbqcthymtxcflmploeihhfei$cGVyc2V1c2VvQHNrLmNvbQ==$sngtbdgxdnarqvoififzoknmcjwwvgdfsavxqguxeedouqmxje

Analysis

user interaction
yes
max time kernel
329s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pinnaclegroup.co.tz/sm/hiworks/?id=tmyyhszzgeoqbviyazrawcsddotbqcthymtxcflmploeihhfei$cGVyc2V1c2VvQHNrLmNvbQ==$sngtbdgxdnarqvoififzoknmcjwwvgdfsavxqguxeedouqmxje
Sample260728-e2kbsaar2y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2660	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296863893388487"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{7ACE9564-C1B9-4103-9CFB-BEBAF0BEA322}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2628	3864	msedge.exe	85
PID 3864 wrote to memory of 2660	3864	msedge.exe	87
PID 3864 wrote to memory of 1672	3864	msedge.exe	88
PID 3864 wrote to memory of 1672	3864	msedge.exe	88
PID 3864 wrote to memory of 1672	3864	msedge.exe	88
PID 3864 wrote to memory of 2976	3864	msedge.exe	89
PID 3864 wrote to memory of 2976	3864	msedge.exe	89
PID 3864 wrote to memory of 5068	3864	msedge.exe	90
PID 3864 wrote to memory of 5068	3864	msedge.exe	90
PID 3864 wrote to memory of 5068	3864	msedge.exe	90
PID 3864 wrote to memory of 1532	3864	msedge.exe	91
PID 3864 wrote to memory of 1532	3864	msedge.exe	91
PID 3864 wrote to memory of 1532	3864	msedge.exe	91
PID 3864 wrote to memory of 4064	3864	msedge.exe	92
PID 3864 wrote to memory of 4064	3864	msedge.exe	92
PID 3864 wrote to memory of 4064	3864	msedge.exe	92
PID 3864 wrote to memory of 4244	3864	msedge.exe	93
PID 3864 wrote to memory of 4244	3864	msedge.exe	93
PID 3864 wrote to memory of 4244	3864	msedge.exe	93
PID 3864 wrote to memory of 4168	3864	msedge.exe	97
PID 3864 wrote to memory of 2428	3864	msedge.exe	98
PID 3864 wrote to memory of 4168	3864	msedge.exe	97
PID 3864 wrote to memory of 2428	3864	msedge.exe	98
PID 3864 wrote to memory of 2328	3864	msedge.exe	100
PID 3864 wrote to memory of 2400	3864	msedge.exe	103
PID 3864 wrote to memory of 2684	3864	msedge.exe	104
PID 3864 wrote to memory of 5060	3864	msedge.exe	105
PID 3864 wrote to memory of 4496	3864	msedge.exe	107
PID 3864 wrote to memory of 4496	3864	msedge.exe	107
PID 3864 wrote to memory of 5116	3864	msedge.exe	109
PID 3864 wrote to memory of 2328	3864	msedge.exe	110
PID 3864 wrote to memory of 2328	3864	msedge.exe	110
PID 3864 wrote to memory of 2328	3864	msedge.exe	110
PID 3864 wrote to memory of 2384	3864	msedge.exe	111
PID 3864 wrote to memory of 2384	3864	msedge.exe	111
PID 3864 wrote to memory of 2500	3864	msedge.exe	112
PID 3864 wrote to memory of 2500	3864	msedge.exe	112
PID 3864 wrote to memory of 2500	3864	msedge.exe	112
PID 3864 wrote to memory of 5016	3864	msedge.exe	113
PID 3864 wrote to memory of 5016	3864	msedge.exe	113
PID 3864 wrote to memory of 4460	3864	msedge.exe	114
PID 3864 wrote to memory of 4460	3864	msedge.exe	114
PID 3864 wrote to memory of 4200	3864	msedge.exe	115
PID 3864 wrote to memory of 4200	3864	msedge.exe	115
PID 3864 wrote to memory of 2768	3864	msedge.exe	116
PID 3864 wrote to memory of 2768	3864	msedge.exe	116
PID 3864 wrote to memory of 4920	3864	msedge.exe	123
PID 3864 wrote to memory of 4276	3864	msedge.exe	124
PID 3864 wrote to memory of 2768	3864	msedge.exe	125
PID 3864 wrote to memory of 2768	3864	msedge.exe	125
PID 3864 wrote to memory of 4276	3864	msedge.exe	124
PID 3864 wrote to memory of 1948	3864	msedge.exe	126
PID 3864 wrote to memory of 1948	3864	msedge.exe	126
PID 3864 wrote to memory of 1336	3864	msedge.exe	127
PID 3864 wrote to memory of 1336	3864	msedge.exe	127
PID 3864 wrote to memory of 3892	3864	msedge.exe	128
PID 3864 wrote to memory of 3892	3864	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pinnaclegroup.co.tz/sm/hiworks/?id=tmyyhszzgeoqbviyazrawcsddotbqcthymtxcflmploeihhfei$cGVyc2V1c2VvQHNrLmNvbQ==$sngtbdgxdnarqvoififzoknmcjwwvgdfsavxqguxeedouqmxje
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,13484575626360863580,7180908268283624052,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,5822377747655813701,2620232093634443425,262144 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,10044247283222537597,8359288890981956125,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,8992757481902127688,4486954824478028454,2097152 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,6425554096976238405,3445448518507648358,2097152 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16079060058760004186,8928343007663119807,2097152 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,18439529902507087828,333380611721584156,2097152 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,7824831337576514654,3998913243684112631,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6673457798205461549,16785104681860642433,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1159056778284162339,13521923327219356629,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1159056778284162339,13521923327219356629,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,4536827400628901574,10782681586486090431,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,1658187270591088196,4540991790555661968,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,12206779350704689585,15010098322157879738,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,5833342549686965260,4957966614703586817,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,5678539975601480868,13446031363204012627,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,5678539975601480868,13446031363204012627,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6268,i,13473321062071529689,1941732574170292700,2097152 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,12916782427840182646,5259866111314452124,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6444,i,2851046497711946297,3680214669500488037,2097152 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3993741249488060716,12871533093452434389,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,14390586998905010030,11798020212688706373,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,2532483680052020973,11994234444759432730,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,12180378309225737009,13939758512071157515,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,8830749362780619116,7489927587453456587,262144 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,2124175536888904863,9862304251897654616,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,17841933489209245831,8276329599777678617,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,12737757493840099080,14897224311595381117,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3116,i,14239928949054315723,10947237539796613340,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,3154230382353245362,12959037713545575461,524288 --field-trial-handle=2336,i,13118611076114548682,455001932514091487,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4d81571dc28b5329f0ababce30eec43117898ff7499389052772d93a10c5eaed
MD5 a7841b6e2ea5db0f10eee8c1cb47813a
SHA1 8a533d9571d20e1b8cfa9d361481253cf4a42064
SHA512 c2acfce329b0637412979661ff3a119d2ccb901454b96ff9c931af3b714751e4b4cad3936757bd21c6e3f8290dedc8039e649c15ff0233a9233c6b62eb942439
TLSH
T10BE026A828C8C26FB208A4474A68530CC2893A6E92C86D9A3708C9D8330D460A3E6990
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 523KB
SHA256 0fdd9b81b67e8a211960fc4716e7fd21c2b858ae924b77ddb44889f0a053d294
MD5 4a9d763f9380e7493876fb4f597ebfb7
SHA1 39141ec613ae977dca4162212cbad697e972701c
SHA512 9ae653854cf817cb57e91e3692386eca71a6b6226d3797ef0c801c59b62928e33daf3f274f24511d951299d52f1d6852c23ddef5e25137c156e0e80381458c6c
SSDEEP 12288:KIsjmTeiTKsAIAd21a6+mA5FIAyKdzu/WO9Bbo4PyJBSpNnHb2:K+thAIAdwDoF7dKP9Bk4P3bHb2
TLSH
T113B423661F4FA28F1F01BC93FC93C0266937E2A2792194EA945ED53875F32340ED361A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ace7484ef503f9ddbe42c01a8a006f442f90108e2fdca98321a9cf40d5315db3
MD5 1f1afcde6494a5ab8823b8294e13a0ff
SHA1 de756906aff2111d9385179afea3333a05758ca2
SHA512 4b8fabe22d77f034fffa8d729a04f28c79def3df7c94856a7b9b8ee9053e5eb08058786de38bd7a9b7ee4588e725ef62198ca457fa230e05400f76a342c5e35e
TLSH
T1A471F64C0052CCD1E3E256F1C0F2F244B4B0B26F3B779AA12674C5BD6519F726369C0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 63b1c686865ae55d3f0603f8085bdf28ce338735ddf4ca04af1c27d1aee9d522
MD5 2aa9d04ad2b070380027530dea784a5c
SHA1 a04ac6220ea7d0c3bbeabe99edfbfd1169e06c76
SHA512 da40ed9f2b7fe0d995bc0dd8bf1164650827ca812c5edef071e11784c0caddaf77c126690bdf7c8436ac9fe50d6a0176fd1ecf4d560a25da14aaf7bca30849f6
TLSH
T19E71F64C0052CCD1E3E256F1C0F2F244B4B0B26F3B779AA12674C5BC6519F726369C0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d184.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d184.TMP
Size 3KB
SHA256 d4358d4e9692e811c326a09149876383b02f19b7e2865a833e24f9e673a28eec
MD5 ea5201a7de6e20256151ed381f920704
SHA1 5fe5c18f30a18c7b50592094ba0aa4725b21854d
SHA512 b6da99a53b4ae04c978a3e1dea3f807b0858c68d5ce65564dedc13ff0ebd013c6ec7159a21cc141ebdc12bbada0daf62c4f342c6da61d462c8df15fb78609529
TLSH
T1A671270C0112CCD1E3E256F1C4F2F245B4B1B26F3B779AA12274C9BC6519F726769C0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\_metadata\verified_contents.json
Size 2KB
SHA256 6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822
MD5 c7182c4ef7a2cd6a57e48d44bfd4af9b
SHA1 2e1e4746da948d83baf4bcebee618784f8ab209c
SHA512 d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83
TLSH
T1BA419322CCA5BC1F293173704EB90662AB0595AB2081295A70FC099D3FF15666436EBD
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\filelist.txt
Size 134B
SHA256 543c0e50c16159439d3dfb3f1151bc64e2f5b60a0e3824c5f93c4c5c14dd945b
MD5 3bf6b4eae5af15288bf0d79702f9cb78
SHA1 b8a052dc4973757ae865661ea0300dea1d27f3b6
SHA512 25e2502ad314635035f303aa1f0f195c28af91d0b51280e5a4c9310aae65aad857073137196f41a9a2fd7ef96e54ce9b329c448d5acf87b10134168ee7652c0c
TLSH
T1C9C04C206C0494B7810CEF55C5F9FD34940616007E33DC8913584270101B68E8DB5324
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\LICENSE.md
Size 9KB
SHA256 4135d3051e1bfdccf0440f6d8867a6dc1e39587694995479c3e29826e53aff63
MD5 e57b8dbca804bf4a2db759fa1a70b3cc
SHA1 8acc131b3698964249b08a0178f7c8c467337048
SHA512 d2ca91851daeadedcda21ecee4cf7c9244cf21a15709e472014ba6a332a374cba80acd165b2650ce2c3994c7d0156376c22db00fe0c47833e0fca466bcb8c627
SSDEEP 192:agW/NVo4UTo1YE+FNzFE6GGfGb2y1CVzho1oHqxQJbbLwY:a7hUk1+bXU4qbQ9l
TLSH
T18E12427F7748137B0AC30172B78BA4DBF32E903C3B9556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

babylon.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\babylon.js
Size 1.2MB
SHA256 b5a426a0769b378e196ab2698c14a326d86ab2443010e16e4ac3cdde06371e6d
MD5 e1adfd8f62854c2d9ce65f13268c1ac1
SHA1 d564ea1d59305bbec12995ee43f1c28838e82519
SHA512 ffdf74b8bba179c7d5d6d49205b8aebfc7b27395852d05f1ae5de5c23b5dfbd87776f2046fad20b652a7663dacf90da0336a802985bad14ba3591bbfd9ca4caa
SSDEEP 6144:j7WIrpHJ1yA3d0xEWv/v/82mXgBYdnU7yTGpjGp8MTYgANTJCpzesRGvJaGpLsXW:vC/ErriNqfGp0KV
TLSH
T175450999B3217926478390A5143F090BA33B68DE940540BCF299D8DFACFD149667BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\typescript\typescript.js
Size 10.4MB
SHA256 986134e07f34257fd85c084441c825d7d8951705a0b8c76b0d7c5499536cc959
MD5 d931cf27eb964f239e5bec661810abf5
SHA1 1616508213014fa7cdb50e691cf737169019c6ed
SHA512 9c2bae1025c1c9579e5e7ba8119e11bc298bbf968aaaaea94f12b8a96155f63bcdbce60deb1445c484aeef3fcfdf96156fc804c2867726617e7b772440989fb6
SSDEEP 49152:noUsnsTsUGJR5dZjSB1FBUWx3pZzoYzuQRlbVbOFeWSeoMTNKtsL4IMltR6SMF9K:BTsUqRIb3nYz1q3X
TLSH
T1D3B6E6BE79E330B16A5B2136672F8001B735D257220CD8907E9CC3A95F1587462EBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 64f89737b0a0c18439cbdf3ccff1cd7c15b437063fc6b0fe98a49a5dfcd49302
MD5 930a7aac0d97870fa65dac3c952dd786
SHA1 1050dda53fe1fb090a181c800675249a40ab83a0
SHA512 34c017eae3384c30e2047cbf1703f90c8f4457c66d29c286cf588d8e55c59520661d7bfc00070d9d670243715fedacdf15afdd4d680f2ca6b8bfa8021f0ecf03
TLSH
T1A641C2F3C3F4856ED91156F0AA14AD27CE1D0A55835C3D6AC5D8AF1B93F24B1D20264F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1d06c7dc828f7a7b208237580f26615f2913e2b6674d769fc6f8ae17b2f5d76d
MD5 ac6af8052f9bf9867b302c15d838c23f
SHA1 287b1a3ac9d6726eb1e50617a56ca32b8cbfb562
SHA512 af6e4cb1c43b237c0474f30749af29cab3edc83e79d30e40c5bcd108309d679848e61d6b8680e80c039e11ec7d98bdebc95fad2ea012eea257e06b450c927614
TLSH
T15A31ABF3C3E5856ED9115AF06A14AE27CE1D0A05831C3D1AC5D8EF2B93E24B1D21265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d6f116402c52e4ba411f2ce7622a2bde4fb698791780094f66893c8a93217fe
MD5 81146dcf30af3e87098d6ff7d816fbec
SHA1 7960ea7397f5fadfd31fdc7e854984bb13f75718
SHA512 4dba99d2ae1731f56c70d55d42ad6e057c218ceb1cc36eb91f85df6899aec1024ceccc71b67b0b353cd034bdbe5276509fb9096cb349abd8189283923e573cfa
SSDEEP 192:sxZiRfyM/jK1Ml8Mk7/fusGiGIdpe3nHW6+WNRNib/YLTs7HIgrJ:sxZiZM7/fusGineXHbRW/v9
TLSH
T10252F8166A345977CCDBC20DBA55BF53DAF51472D2900E44A9FC8A0C04E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ac195746d6ea08a0bb7dadadf079b7f3260a266664d7a6722fedc1605e02ad58
MD5 f984dde4d0b6eab7f4085f1f5f737077
SHA1 63acf3763446280604b10cf22448e07530eb60ff
SHA512 33b422238fbc1e7dc25f063b5148e1d87028f1f4cc7ad622a555e37b8989f65b4135eeba8db5dae44b9fd6c90a10f4081eb541b810ed720a74241349f0dcbdd6
SSDEEP 384:sxZoZMD/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGestXIMDHbRLZTFh:swGD/f3jfW9RC8wAe/XZHbbph
TLSH
T13992D8069420ED77CCD6921EBA757E63D9F5466283802D5C69FCCB0C40A6BFD225B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 850d65480a6d60586dadb310438213e80b9f22fbea02d0b4ab02d2cc78e08e1e
MD5 cfba27e82cf3ef6a92918afa85596f7f
SHA1 d11f41bb869c0a59bf39a336713fb6dc645bd7cd
SHA512 2f3935449cd9d78c7eef226e37122b67529d17890b6adbc9ee80cee9b649054fc032c58a945d3e7ce16f7bbceb6fb8b2f016766376c441b041f13f0229eac6c5
SSDEEP 384:sxZoZqbD/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGqstXZOhMyHbRmnbFh:swAbD/f3jfW9RC8wAeDXIzHbaxh
TLSH
T19292D9065420ED77CCD6921EBA757E63E9F54662C3902D5C69FCCB0C40A6BFC225782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 469b3aac2d6e4c9ba35b739e8d3b7cdb1503a49e12636f9e34dd378b1bc3c41d
MD5 5c68234e79fb17b61e507b2fcba963b0
SHA1 95fd0b71b54a11cacdce8e071cb0d0d47d2e70b4
SHA512 da7c6695eb579d19e3e07368a1ebb0a4d61bcce847b2ef397a1997beabb6da92247efff2ec7bd39043ace2e4c4df8af3f09f2b9fdb83f1654d0ded7666f640b0
SSDEEP 768:8rJ5s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVNILlWwJNProud:8rJ5s6pD1WvxzWju1jaiNILIsNcud
TLSH
T126E20B3B280CCB7E4F844A5CEC2AAF977DD8018BAB948D5447FA854C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c64042eabb29070744b2a5f44f0d10cc7ac5fd1a16c2624cfc59e5b18a1f7db7
MD5 2f5fae7611b603c228b68afbcbdd9bce
SHA1 4023aa556f4f429a0a75de42d8891450bda7caea
SHA512 3e627523a29ac198cb5d838f9895aaad5a7440861e90d24dfe67f1398f6c8c59c13db5f1c75cc276756e7652f64fcce30ee0179d922a77482d0b8502c357ee31
SSDEEP 768:8es6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNProsM:8es6pD1WvxzWju1jahILIsNcsM
TLSH
T18DD2FA3B680CCB7E4F841E5CEC2A6F967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fe1854b600a7405fd54c07af0c389bc3487537aad9487ccdff06d6e49d33c173
MD5 eb70a0dc57e6ed1c1fa811ddb667e4d0
SHA1 6b9233a810a5fbb221d9a70c864bccb1954cb28a
SHA512 29c4be5b7312476118b96dacdd971ccc237c5fb8231733b16f8cb443d3fcbb014845fec31ae9f95e5ecd28dd26bef4fe626448557fa4721c7cbe2ed11f6f3a3f
TLSH
T152E06FBB2EA32830EDABE3E3283090B10641382CC800BC0F686AAAC354B03113802C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 dd8fbb5d5a30d3872ed135b16d5ec4877f23b8393dc38f33ef38b12ffb34be19
MD5 24363e8064a31133acf2db779465816a
SHA1 8a9f7956c2d57cf1ae78a6f14141d7cc824fd84b
SHA512 13108eed729cb50cb1ec4c7965c30c652a3f2f7cb30e6e500362ff6172ade6f397a29978cb50e675a6c1a792d557281bac11065c6c5e76f2a6e4fb6edd5f6fe8
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCkR:ii9J3aJxI
TLSH
T1B2E1E11232BB02123D3E691C935987676F427AA33418E42B77AC10B61E66E344DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5969dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5969dc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f67e8351c65ef1dbae17afd52d0f4bcd51e5a54317b6ef087d3368c7875308fe
MD5 6f2d468ba83c89364bc0f0231caaf484
SHA1 c330dc42c7f544ead3cd3175bb04d90b0b7649ba
SHA512 3b8166ac63a7a40fe2a72a13cda3a6e3a84debd669d5e567a984843b5a3d94daaf7482827ae83d4ea054f8bd847ba6b17d8dd445fb674247cd26f7a74fffc800
SSDEEP 384:IZcIhsN8RGQbAa9ndQcMZmOObjI9G6w7dZ:2hPpRGJm29MdZ
TLSH
T1A8927D326C386D7759B3A502F98639278FF49037DBD92F80E1EDDB0C01EA56C131681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a014e0b938180385ca8d1f6178a13eef0863c0ad37b36cd1e0cd4e07c9b7ebda
MD5 9135363f3163a14afda9c41039c9f62c
SHA1 ce915f6165064911cd2ef7e0b0b89eb6646078ea
SHA512 9051c000c5834a74fa6dbdf2a0f97936d66b4ecfd4cbec69f3fa2e510593a5de9c53ef62d3c2f9984347d3050292d2a85536713011d896476aa0c139444a466b
SSDEEP 192:qONa6O7+3hQmiUyHpGttb0h+FdPougGXCU6:qONa61OGt9ndQwyU6
TLSH
T18002D7396C686CB78EF3AD46F5872A175FA8117BE9962F80D6E85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9068333a7935e9320b7de62acf808ec59e1628c5addf84df126cc50692b51b72
MD5 b17fa899fa692314297bc72c69578785
SHA1 73abebc9085e8f20b7119fe60d1c18d571e374e7
SHA512 7cf78f00ee9d631fbc3d8acb5d4997ba1153c59592af4a537526e9a0cb07d6524740fff3ee61c705b6bda2cb124d43b6aa1f31d08bc95a743c61d2ff05005320
SSDEEP 384:xZcIhsN8AGQbAa9ndQcMZmOObjI9G6w7dZ:Zh6pRGJm29MdZ
TLSH
T19A928D326C386D7759B3A502F98639278FF49037DBD92F80E1EDEB0C01EA56C131681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5aab296536fe040e664fc00d3879e7eab85b3ae85282932f19be93099ab54a5b
MD5 8c6b9bfa02a82dcc75c4c3f962ab9910
SHA1 9b7320b3f133319b184cd9461c16993e95dc6eaa
SHA512 26aee0e73975b79333d6856a14b296011f2cf99de34fc6cde20f8a62a4604c63217fe12c5c4c2e41d496caa5688b72a666d5efff28ceca6d08770f3b429d4d97
SSDEEP 384:X/iFiZcIZzsN08TUNTUlIlRGQFQAa9ndQcMQmOObjI9G6w7dZ:aFQZxwg4pRGAm29MdZ
TLSH
T146D218F25CD74976D9AE5B03A77E2D124EBDC027F6956A40B3D89A0CCC961BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9439a6598202414ed279dbcf7e45d839fa818f69cc3bb0e2fd2241c7bee76a8c
MD5 dc46310913048419f51360bce0e663e5
SHA1 13f0c69f7846767cda219d59cf5c25bc835bb9e3
SHA512 31bc1a08d6c0137f594d4d3e1941a67f27e6005f73a5a07dbef44b933b5f25cfe213a733d9a58d96aaf3e3b376d067551a6d53ff4a933ea90c71309746980e7b
SSDEEP 192:PON16O7+3rQmiUy2pgttb0h+FdPoYRh2vLcNgrqKjU6:PON16bdgt9ndQcMYmU6
TLSH
T12712F8356C68AC775EE3A546F48735138FA54167EE8A3F80E6EC5E0C01EF66C2346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c0ad2c939886ad24c1d71402dfdae212b0372d10f2089190dc4312545f199b25
MD5 4d299f12df19b34491a8748d3e2c5855
SHA1 e18cb87a55c7582cc91baf70693154084549257c
SHA512 bb2c606245d3044b28c18dc4f7364439bb65f0894ec7e8193876e3f93a87db6e06a0eaf3550e2742dca13b48a1005e1a2861cbef8756475830f12e6d55ded32e
TLSH
T1BDE002015300006AC12943300083562067E1D01146A20357450001641C023001E24A81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a200c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a200c.TMP
Size 392B
SHA256 916c2f14475747cec9d90c7c28b9ae43d19693520f3b7ca2fca07b2ea1cf01c6
MD5 9b2e4271dd11543fb95b201bfadca2d3
SHA1 5812a495116a53a0acd17afd90e59b2f65f9ebf9
SHA512 2eaecacfd9c87287a17f158c8fd67a803a4a60e16f5f3f3c5b0296f44c5a078926a3911faddda5d60c4aa46735696f690acb6eaaccb2d7f529ceae01f62ca464
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4bd18532c91e51031564c7933fb56ebf64338e0c97ea6b7c372824359a35e9db
MD5 b0f5f279026fc1282b7c33c814c43ca7
SHA1 9702ae0f92e4e97d73c85e4898dd8fca4c3016b2
SHA512 cb312c9379655066f34266fe1f96001934c4a8b746bfe5a9162fae5c7876968a2ac741dcf84ad39333bac4baaa7959977a40c5f779ef53eff9300f8e08796f10
TLSH
T18741EB58BAFA115C73776E5A9BF6785D487F79672E06C45E00010D4F0663A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

81d3ffa1-d683-4a28-a96f-f49e415ffa25.tmp

Path C:\Users\Admin\AppData\Local\Temp\81d3ffa1-d683-4a28-a96f-f49e415ffa25.tmp
Size 2.1MB
SHA256 efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07
MD5 4cd67032e35fa92f5182df10df289906
SHA1 9210bfc66bd808ffcd7c6443e160dc8d6754c416
SHA512 f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd
SSDEEP 49152:ykR5Xz/3zNOm3NOHF4+n/UlfmCSJdm8IKXmiQeujzX:DVEkNOHJQOtICGb
TLSH
T166A533BB93AD6C15F3A88C67DCDD498641C2798E6161B7F619837C282ADC07CB47CE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f22e753-c0a2-4bd2-acda-907befb39193.tmp

Path C:\Users\Admin\AppData\Local\Temp\9f22e753-c0a2-4bd2-acda-907befb39193.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fd28db07-b87f-4f18-8d8d-f370925382b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3864_1067983436\fd28db07-b87f-4f18-8d8d-f370925382b4.tmp
Size 3.0MB
SHA256 2d69203739eca77886457d27c0df44eca47da02810061a7f5e15288c2e643f23
MD5 06f47f5ad37fb94be87982adc116d012
SHA1 4899ca7b1be75f8607b00b59b8469c8072f514ef
SHA512 b9ccbc3f2c45eaefcc4e157fb19eafd10eb54465f514ad16ada25e81390c3d577fa52aa6fc03461de6726694cdfda15ea96c5420609ac7a426e7b5afa43cab46
SSDEEP 49152:nqSGYpZHVTcorMCTt7OQvYilFbQ0NyNLvTAIPvWcfbcFlTfTGquf:n5pXTcoYCTYQAybMg7cfbcFPc
TLSH
T159E53395F69FF0F4D9A5F3317F8C765F16AAD387A30091D84283204A7BA9E210A5DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3864_659890814\CRX_INSTALL\manifest.json
Size 658B
SHA256 fea905b763b26db02673c6ab14f422b21eff64de59351f0818b501dd4e7f9430
MD5 2cf796650e5ad5bfb6c4a421d81734be
SHA1 79298d3cdd584b290d825d6fff4b857012e71992
SHA512 1ee7604bd7293d6296cf1368ed0dadaad7359f4d00be75e7730a9704b2205438a06ba7361554437b3e6ef352482011a90500769ff713949716c24355ee742e33
TLSH
T17A01233A268140F238347640087155A4F176620B9100F8053835E36EC460BFDBD79A6D
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3864_659890814\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download